Podchasov vs. Russia: ECHR Rejects Encryption Backdoors
Recently, the global conversation on digital privacy has been significantly influenced by the landmark case of "Podchasov vs. Russia" (ECHR Appl. No. 33696/19), a legal battle involving the messaging app Telegram and the Russian government. The ruling of the European Court of Human Rights (ECHR) stated that the storage of communications data without adequate safeguards against abuse cannot be regarded as necessary in a democracy society. The ruling specifically stands against encryption backdoors. It underscores the critical challenge of balancing state security measures with the fundamental human right of privacy and offers a legal precedent.
Anton Podchasov is a Russian Telegram user who took the government to the ECHR because Russia’s laws forced messaging services to store everyone’s communications, give security services access to them, and even decrypt encrypted chats. He argued this violated his right to privacy — and the Court agreed.
This is all taken originally from this full report on the case: https://hudoc.echr.coe.int/eng?i=001-230854#{%22itemid%22:[%22001-230854%22]}
Background
In 2017, a significant legal battle unfolded in Russia, pitting the popular messaging app Telegram against the Russian government. This conflict was ignited by the Russian Federal Security Service (FSB)'s demands for the decryption of messages, a move rooted in the controversial "Yarovaya Law." This law mandates telecommunications services to assist security agencies in decrypting user communications, justified by the Russian government as a necessary step in combating terrorism and protecting national security.
Critics of the law argued that such measures would lead to the creation of a "surveillance state," where citizens' private communications could be monitored without substantial checks and balances. Telegram, renowned for its commitment to user privacy and strong encryption, found itself at the forefront of this debate.
In 2017, the FSB filed a lawsuit for the non-fulfillment of the Yarovaya law by Telegram, with the judgment delivered in favor of the FSB. According to Pavel Durov, one of the founders of Telegram, the FSB's requirements were not feasible:
Anton Podchasov's legal battle began when the Russian government blocked access to the Telegram service in 2018. His involvement stemmed from his personal use of the app and his concerns over privacy rights, making him a key figure in the legal battle against the Russian government's demands for decryption. Podchasov's lawsuit, after being dismissed by the nation's supreme court, was ultimately taken up by the ECHR, which ruled in his favor.
Findings of the ECHR
In its landmark ruling on February 13, 2024, the European Court of Human Rights (ECHR) issued a decisive judgment in the case of "Podchasov v. Russia," addressing a controversial issue at the intersection of privacy and state surveillance. The court's findings focused on the statutory requirements under Russian legislation, notably the controversial Information Act and Order No. 432 of July 19, 2016 (Yarovaya Law). These laws compelled information communications organizers, such as Telegram, to store all internet communications and related data and to provide this data, along with decryption tools (backdoors), to law enforcement upon request.
The ECHR closely inspected the far-reaching effects of this legislation, considering its substantial implications for users of communication services. The court underscored that the legislation indiscriminately affected all users, irrespective of any reasonable suspicion of involvement in criminal or national security-threatening activities. This blanket approach raised serious concerns about the potential for unchecked state surveillance.
In its critical analysis, the ECHR identified several key issues:
- Broad Scope of Surveillance: The court emphasized that the legislation's expansive reach, affecting all network users, constituted a significant interference with an individual’s private life.
- Lack of Adequate Safeguards: The ECHR found the legal provisions governing surveillance to be lacking in effective guarantees against abuse. This deficiency heightened the risk of arbitrariness, making the surveillance measures susceptible to misuse.
- Impact on End-to-End Encryption: Central to the court's deliberation was the impact on communications protected by end-to-end encryption. The requirement for de-encryption, as mandated by Russian law, was found to affect users indiscriminately, infringing on the privacy of individuals who posed no threat to legitimate government interests. The prospect of creating backdoors for decryption was particularly troubling, as it could enable routine, widespread, and indiscriminate surveillance of personal electronic communications.
The ECHR's conclusion was indisputable: the access to and potential misuse of electronic communications content, on such a generalized scale and without robust safeguards, severely impaired the right to respect for private life. This infringement was in direct violation of Article 8 of the European Convention on Human Rights. The court's ruling, thus, marked a significant moment in the ongoing global dialogue about the delicate balance between state security measures and the preservation of fundamental human rights in the digital era.
Limitations of the Ruling
While the ECHR's decision in the case "Podchasov vs. Russia" marks a stance in favor of privacy rights, it is important to understand the specific context and limits of this ruling:
- Contextual Application: The ruling specifically addressed the legal obligation to decrypt end-to-end (E2E) communications, effectively creating backdoors in E2E encryption.
- Support of Alternative Solutions: The court supported alternative solutions that do not undermine protective encryption mechanisms, including traditional policing methods, undercover operations and metadata analysis.
- Derogable Right to Privacy: It's important to note that the right to privacy, while fundamental, is considered a derogable right under certain conditions. In extreme situations, such as a declared state of emergency threatening the life of a nation, governments may derogate from this right as necessary to address the emergency, as outlined in Article 15 of the ECHR.
This aspects underscore the complex balance between individual rights and national security interests that courts and governments must navigate.
Further Implications
The ECHR's ruling in "Podchasov vs. Russia" sets a precedent with far-reaching implications about the limits of state surveillance in the digital age. Governments grappling with the balance between security and privacy may need to reevaluate their laws and practices, especially those involved in collection and analysis of digital communications, such as UK's "Online Safety Bill". If similar requirements for weakening encryption are part of this bill, there is a potential concern that it might face challenges in domestic courts or even the European Court, based on the precedent set by this ruling.
EU Chat Control Sentiment by Country (Summer-Autumn 2025)
The EU's Chat Control proposal, aimed at detecting child sexual abuse material via chat scanning, saw shifting positions through late 2025, with the Council adopting a negotiating mandate in November that dropped mandatory scanning for voluntary measures and risk assessments, amid ongoing trilogues expected into 2026. Trusted sources primarily reported binary stances (support/oppose/undecided) rather than nuanced sentiment volumes, limiting granular PRO/CONTRA counts; relative PRO ratios (PRO / (PRO + CONTRA)) are derived from explicit mentions across sources, using 1 unit per unique trusted reference per stance. Countries lacking explicit mentions default to 0/0 (undefined ratio).[1][2][3][4][5]
| Country | PRO Units | CONTRA Units | PRO Ratio |
|---|---|---|---|
| France | 4 | 0 | 1.00 |
| Italy | 3 | 1 | 0.75 |
| Spain | 4 | 0 | 1.00 |
| Denmark | 2 | 0 | 1.00 |
| Sweden | 1 | 1 | 0.50 |
| Hungary | 2 | 0 | 1.00 |
| Ireland | 1 | 0 | 1.00 |
| Cyprus | 1 | 0 | 1.00 |
| Latvia | 1 | 0 | 1.00 |
| Lithuania | 1 | 0 | 1.00 |
| Bulgaria | 1 | 0 | 1.00 |
| Croatia | 1 | 0 | 1.00 |
| Portugal | 1 | 0 | 1.00 |
| Romania | 1 | 0 | 1.00 |
| Malta | 1 | 0 | 1.00 |
| Austria | 0 | 2 | 0.00 |
| Finland | 0 | 2 | 0.00 |
| Czech Republic | 0 | 4 | 0.00 |
| Netherlands | 0 | 3 | 0.00 |
| Poland | 0 | 3 | 0.00 |
| Belgium | 0 | 2 | 0.00 |
| Germany | 0 | 1 | 0.00 |
| Luxembourg | 0 | 1 | 0.00 |
Sources:
• Full ECHR Judgment: https://hudoc.echr.coe.int/eng?i=001-230854
• Communicated Case Summary (background + legal questions): https://hudoc.echr.coe.int/eng?i=001-211286
• Academic Legal Analysis (Ghent University PDF): https://backoffice.biblio.ugent.be/download/01HSSD44R19CGSYXKF6KSWHFYR/00.pdf
• Privacy International (intervening organisation): https://privacyinternational.org
• European Information Society Institute (intervening organisation): https://eisi-io.eu
• Expert Summary – Centre for Democracy & Technology: https://cdt.org/insights/the-european-court-of-human-rights-concludes-encryption-backdoor-mandates-violate-the-right-to-private-life-of-all-users-online/
• United Nations Report on Digital Privacy (cited in the case): https://www.ohchr.org/en/documents/thematic-reports/ahrc5117-right-privacy-digital-age
• Council of Europe Resolution on Mass Surveillance (cited in the case): https://assembly.coe.int/nw/xml/XRef/Xref-XML2HTML-en.asp?fileid=21736
• join.tech