You can make it technologically impossible, but they can also come and arrest you just for using such technology. So its not really a technical problem, its a social/political one.

It needs to be done on both fronts.

Privacy-conscious apps and communications tools need to be developed, and we need to build the consensus that privacy is important.

Sure, but then they need to send a physical person, which is expensive and impossible to scale. Making it extremely expensive is probably good enough.

(Feels like we have this same discussion over and over on HN.)

I don't understand this take. There is no real way in which a private person can make law enforcement "more expensive". The government can always find means as long as it is supported by a sufficiently big fraction of its people.

1 person using encryption vs 1 million people using encryption.

Sure, they won't go out and arrest all one million, but from an individual perspective it's basically security by obscurity.

Once that's the case, otherwise legal activities (e.g. protesting, or making political statements) run the risk of making you a target. Law enforcement can then punish you for your legal activity by selectively enforcing this other law.

The resulting situation is one where everyone knows to some extent "you better shut up if you know what's good for you", and puts a chilling effect on otherwise legal forms of civic engagement.

You might point out that there are already laws on the books that let them do this, but I'm sure they wouldn't mind another.

I don't think there's a way with a phone that people would actually be willing to use. At some point it has to be decrypted to be displayed to the user and there's always the chance there's a flaw somewhere in the stack from hardware to OS to app etc that will have a gap to exfiltrate the data.

Avoiding centralised services is generally a good start. You could also do something like encrypt any messages through PGP even if the service you're using is already "e2e encrypted" like iMessage or signal

https://xkcd.com/538/ User data can only be as safe as the user.

The problem is they'll legislate for the providers to insert back doors, negating cryptographic hardness.

They have to make custom software illegal at some point.

They don't have to make it illegal. They can just create all kinds of barriers like only allowing government approved OSes for essential services, and then using custom software can become grounds for suspicion and subject you to searches, etc.

I'm certain this is the direction we are all heading, unfortunately.

Governments will sanction the major proprietary OSes and compel Apple, Google, Microsoft to participate in their surveillance programs, and those will have remote integrity attestation and will be the only hardware and software you will be able to use to access essential services and the internet as whole, most likely.

The usage of alternative software won't be outright illegal, but will get you on a watchlist. Like you said, they don't need to make other software illegal, just make circumventing the blocks illegal.

They can't arrest everyone, but, it's one more gray area thing that can and will be used against you should the government ever decide they have a bone to pick with you specifically so you can get away with it for a long time, until suddenly you don't.

Given how many of these stories have been coming out, I'm sure they're considering it.

There are no technical solutions to human problems. This has been explained over and over again, most famously in Randall Munro's XKCD comic where the secret police resort to hitting someone with a $5 wrench until they give up the password.

If you're in a repressive state and you're worried about your data being exfiltrated the best security practice of all is not to create records of illegal activity. If you have to store such material, don't keep it on a communications device, put it on an external storage device, hide it somewhere outside your home, and don't tell anyone about it.