Switzerland’s Difficult Balance: Fighting Organized Crime Without Damaging Privacy Technology
Switzerland is confronting a policy question that reaches well beyond its borders: how can the state give investigators the tools needed to pursue organized crime while preserving the legal trust that helped make the country a major home for encrypted email, cloud storage, VPNs and other privacy technologies?
The question has become urgent because both sides of the argument have credible evidence. Criminal networks do use encrypted communications and anonymity services to conceal ransomware, fraud, data theft and drug trafficking. At the same time, strong encryption protects hospitals, companies, journalists, human-rights defenders and ordinary citizens from criminals, hostile governments and commercial surveillance. A rule designed to reach a criminal service can also weaken the security of millions of legitimate users.
Switzerland’s proposed changes to its Ordinance on the Surveillance of Postal and Telecommunications Traffic have therefore produced an unusually sharp conflict between public security and economic identity. The government says the framework must reflect how digital crime now operates. Privacy companies and civil-rights groups warn that broad obligations could make Switzerland less attractive as a jurisdiction for secure technology, while encouraging firms to move infrastructure and jobs elsewhere.1 2
Why the debate has become urgent
Swiss police-reported cybercrime rose to roughly 65,000 cases in 2025, almost three times the level recorded five years earlier, according to figures cited by Swissinfo from the National Cyber Security Centre.1 The increase reflects a wider change in criminal activity. Organized groups now combine malware, stolen credentials, cryptocurrency payments, social engineering and hidden infrastructure across several countries. Investigators often need information held by private platforms to connect a suspect, a device, an account and a financial transaction.
Switzerland’s Federal Office of Police, known as fedpol, has also made organized crime a central focus of its 2025 annual report. Its work depends on cooperation among federal authorities, cantonal police, prosecutors, customs officials and foreign partners.3 That institutional reality makes digital evidence important: a Swiss investigation may involve servers, victims and suspects in multiple jurisdictions at the same time.
A recent Europol operation illustrates the operational problem. In May 2026, authorities from several countries dismantled “First VPN,” a service marketed in cybercrime forums as a way to hide ransomware attacks, fraud and data theft. Investigators dismantled 33 servers, accessed user information and generated intelligence linked to 506 users. Switzerland participated through the Zurich Public Prosecutor’s Office III and Zurich Cantonal Police.4
The case does not show that VPNs are inherently criminal. It shows that a provider deliberately built around criminal use can become an important part of a criminal ecosystem. The investigative challenge is to target that provider and obtain evidence through lawful, proportionate methods without treating every privacy service as a suspected accomplice.
What Switzerland is proposing
The reform debate has included several different descriptions of the draft, reflecting its movement through consultation and political review. Swissinfo reported that larger internet platforms could face data-retention and cooperation requirements similar to those imposed on traditional telecommunications operators. The thresholds described in that account include more than one million users or more than CHF100 million in Swiss revenue for two consecutive years.1
The Record reported a broader and more demanding version of the proposal. It said providers with more than 5,000 users could be required to collect government-issued identification, retain subscriber data for six months and, in some cases, disable encryption.2 The same report stated that the proposal’s implementation date was unclear and that consultation was still relevant to the process.
These accounts should not be read as proof that every requirement will become binding in its reported form. They do reveal the central policy choices under discussion. Authorities want clearer duties for digital service providers, access to subscriber information and a more consistent mechanism for obtaining evidence. Critics fear that the result could be identity checks for users who currently register anonymously, systematic storage of metadata, and technical requirements that are incompatible with end-to-end encryption.
Metadata deserves special attention. It may not contain the content of a message, yet it can show who communicated with whom, when the interaction occurred, which IP address was used and what device or port was involved. Repeated patterns can reveal a person’s professional relationships, medical concerns, political activities or location. For that reason, privacy advocates argue that collecting metadata at scale can create an intrusive record even when message content remains encrypted.2
Why privacy technology is economically significant
Switzerland’s attraction for privacy companies is not based on a single statute. Article 13 of the Federal Constitution protects privacy and personal data. The country also offers legal stability, a long-standing culture of confidentiality, a neutral international image and procedures that many technology companies consider predictable.1
Companies such as Proton, Threema, Nym, Tresorit and Infomaniak have built products or marketing around that institutional trust. Their services differ, but they share a commercial proposition: users should be able to communicate, store information or access the internet without exposing unnecessary personal data to attackers, advertisers or governments.
Proton, headquartered in Geneva, has become one of Europe’s largest privacy-technology firms. Swissinfo reported that the company had paused some infrastructure investment in Switzerland. The Record reported that Proton planned to move most of its physical infrastructure out of the country and invest more than €100 million in the European Union. The company presented the proposed rules as a form of mass surveillance and argued that they could undermine the reason customers choose a Swiss provider.1 2
The economic risk is not limited to a company’s servers. A privacy firm’s jurisdiction forms part of its product. Customers assess where the company is incorporated, which courts can issue orders, what records the provider keeps and whether the provider can technically access encrypted content. If Switzerland becomes associated with compulsory identity collection or weakened encryption, a competitor in another jurisdiction may gain an advantage even if the Swiss company remains technically excellent.
The security case for stronger obligations
Government concerns are not theoretical. Law-enforcement agencies face encrypted criminal marketplaces, ransomware groups and infrastructure providers that are intentionally designed to resist identification. When a service keeps no useful records, accepts anonymous payment and refuses cooperation, investigators may be unable to connect online activity with a real person, even after a serious offence has occurred.
A clear legal framework can improve accountability. It can define which providers must respond to a court order, establish deadlines, preserve evidence and punish deliberate concealment of criminal activity. It can also reduce uncertainty for companies that want to cooperate but need a precise legal basis for doing so.
The First VPN operation offers a useful model. Authorities did not need to outlaw VPN technology in general. They pursued a service that was deeply embedded in the cybercrime economy, worked across national borders and used technical and judicial cooperation to identify infrastructure and users.4 That kind of targeted operation is more compatible with a free digital society than a rule that assumes every user of a privacy tool is a risk.
Switzerland also faces threats from hostile states, espionage and attacks against critical infrastructure. A government may reasonably argue that the country cannot preserve rules written for an older communications system while criminals and foreign intelligence services exploit modern platforms. Data requests to Switzerland’s Postal and Telecommunications Surveillance Service reportedly rose by more than 30% in 2025, adding pressure for a clearer framework.1
The risks of weakening encryption
The strongest objection is technical. End-to-end encryption is designed so that only the communicating users can read the content. If a provider is required to create a decryption capability, maintain a universal access mechanism or redesign its service to permit routine interception, that capability can become a target for criminals and hostile states. A weakness introduced for one legal purpose does not automatically remain available only to trusted investigators.
There is also a jurisdictional problem. Many privacy services operate globally. A Swiss rule may affect people who never live in Switzerland but use a Swiss-based provider. Mandatory identification can expose dissidents, journalists and vulnerable communities whose safety depends on anonymous communication. Retention of subscriber records can create a valuable database for attackers, even if authorities use it lawfully.
The issue is also one of proportionality. Investigators may need access to specific evidence in a serious case, but that need does not automatically justify collecting the same information about the entire customer base. A sound framework should distinguish targeted preservation from bulk retention, content from metadata, and providers built for criminal use from ordinary privacy services.
A better route: targeted capability, strong oversight
Switzerland can protect public safety and its privacy industry if it chooses precision over indiscriminate access. Four safeguards would help.
First, obligations should be tied to the provider’s actual function and risk, not simply to user numbers. A secure email company, a VPN, a cloud-storage service and a criminal hosting operation do not create identical investigative possibilities or risks.
Second, access to data should require independent judicial authorization, a defined offence threshold and a clear explanation of why less intrusive methods are insufficient. Emergency powers should be narrow, time-limited and subject to later review.
Third, the law should protect encryption itself. Providers should not be compelled to build generalized backdoors or retain plaintext that their architecture was never designed to hold. Where a service can lawfully provide limited account information, that obligation should not be converted into a duty to make every encrypted conversation readable.
Fourth, transparency and technical consultation are essential. Parliament, courts, cybersecurity researchers, companies and civil-society organizations should be able to test whether a proposed duty is feasible, secure and proportionate. The public should know how often powers are used, how many requests are rejected and whether data is deleted after an investigation ends.
These safeguards would not eliminate the conflict. They would make the conflict manageable. They would also help Swiss firms explain to international customers that cooperation with a lawful investigation does not mean routine surveillance of all users.
Closing Thoughts
Switzerland should not be forced to choose between public safety and privacy as though one must disappear for the other to exist. The country’s strongest position is to defend both, but with different tools. Police need focused access to evidence in serious cases. Citizens and companies need encryption that remains reliable against criminals, corporations and states.
The most credible policy is therefore neither unconditional secrecy nor permanent surveillance. It is a system in which investigators can follow evidence, judges can control exceptional access, companies can comply with precise orders and the public can verify that exceptional powers are not becoming ordinary practice. Switzerland built part of its digital economy on trust. Preserving that trust is a security objective, not an obstacle to security.
What does this actually mean?
It means the proposed Swiss rules could affect more than criminal suspects. They may influence how privacy companies design products, what information users must provide, how long providers retain records and whether firms keep infrastructure inside the country. The final effect will depend on the wording adopted after consultation and on the safeguards applied by courts and regulators.
For law enforcement, the debate is about closing evidence gaps created by online anonymity and cross-border infrastructure. For the technology sector, it is about whether Swiss jurisdiction still offers a meaningful privacy advantage. For ordinary users, it is about whether secure communication remains secure by design or becomes conditional on identification and stored metadata.
Why does it matter?
The issue is important because encryption is part of the basic security infrastructure of modern life. The same tools that protect a bank transfer, a medical consultation or a journalist’s source can also hide criminal coordination. A democratic state must respond to the second problem without destroying protection against the first.
Switzerland’s decision will be watched by other countries facing the same pressure. If it adopts narrow, reviewable and technically realistic powers, it could demonstrate how a privacy-centered jurisdiction can support serious investigations. If it adopts broad retention and weakened encryption, it may lose companies, credibility and security while criminals simply move to another platform.
References
Comments