“Very effective for online criminals too.”

That was the comment. Posted under a privacy stack, the kind of post that lists Signal instead of WhatsApp, GrapheneOS instead of stock Android, Proton instead of Gmail. Eight words, no elaboration needed, because the eight words weren’t really an argument. They were a verdict, delivered the way verdicts usually are online, confidently, finally, with nothing underneath it.

It deserves a real answer anyway, because it is one of the oldest objections in the privacy debate, the kind that gets the fact right every time and the conclusion wrong every time.

the lock argument#

Yes, privacy tools are effective for criminals. So are locks. So are curtains. So is cash in an envelope. So is a sealed letter, a closed door, a hand cupped around a whispered sentence. Anything that protects information from view protects it from everyone, the people you are protecting yourself from and the people you would never have thought to.

This is not an insight. It is a property of the tool. A lock that only worked for honest people would not be a lock, it would be a magic trick. The same engineering that keeps a stranger out of your house keeps a burglar out of someone else’s. You do not get to keep the protection and lose the side effect. They are the same mechanism, viewed from two directions.

Cybercrime did not arrive with Signal or GrapheneOS or a list of alternatives on a slide. It predates all of it, and it will outlast all of it, because the actual mechanics of cybercrime, social engineering, stolen credentials, unpatched systems, human error, have almost nothing to do with which messaging app a person uses to talk to their family.

what the syndicates actually build#

Serious, organised cybercrime does not shop from a public list of privacy tools. It builds its own.

Over the last decade, multiple law enforcement operations have quietly broken into custom-built encrypted phone networks sold specifically and exclusively to organised crime groups, running on hardware stripped of cameras, microphones, and GPS, with subscriptions costing thousands of dollars and a vetting process tighter than most banks run. These networks were never advertised on a privacy blog. They were sold through closed channels, to people who already knew who to ask.

That is the level serious crime actually operates at. Custom infrastructure. Closed networks. Money and vetting as the access control, not a download link. A consumer privacy stack is not the threat model that infrastructure was built to evade. It is, if anything, beneath what professional crime already uses, and it was beneath it before any of this gear existed.

who the stack actually protects#

Meanwhile, here is the actual population a privacy stack serves, the part nobody puts in the comment section. A journalist protecting a source. Someone who left an abusive partner and does not want a new address findable through a data broker. A person in a country where the wrong search history gets you a visit from someone. A small business owner who would rather finish researching a product before the sales calls start. Anyone who simply does not want their habits sold, repackaged, and used to nudge them, which is the default condition of being online without these tools, not the exception.

None of these people are the threat model the comment was imagining. All of them are the actual base a privacy stack serves, by a margin so large the criminal use case barely registers. The comment inverts the ratio because the ratio is invisible. You never see the relief of the person who finally felt safe enough to leave. You only hear the one line about the bad actor, because that is the only version of the story anyone bothers to write.

the quiet#

I noticed something else recently, smaller than the comment, and it sat with me longer.

A few people, not many, just enough to register, peers, friends, went quiet after reading some of what I write here. Not hostile. Not arguing. Just quiet. I cannot know their reasons and I am not going to invent them. But I can say what the quiet rhymes with.

Once an interest in privacy gets treated as a signal of something to hide, the cost does not stop at tools. It reaches conversations. People stop bringing things up, not because they were persuaded out of caring, but because caring out loud started to feel like a small risk, not worth the friction. That is the actual price of the nothing to hide argument, and it never shows up in a debate. It shows up as silence at a dinner table, or under a post, or in a friendship that got a little quieter for reasons nobody named out loud.

the same argument, thirty years later#

None of this is new, and that should worry the people making the argument more than it worries the people building the tools.

In 1991 the United States government investigated a programmer for criminal arms trafficking, because he had published strong encryption software for free and people outside the country had downloaded it. The reasoning was identical to the comment that started this piece, just with higher stakes. Strong cryptography helps criminals. Helps the people you are afraid of. Keep it out of civilian hands.

The investigation went nowhere, eventually, and the encryption it tried to suppress became the protocol underneath the padlock in every browser, the layer that makes online banking, commerce, and logins possible at all. The thing that was supposedly too dangerous for ordinary people now runs quietly behind almost everything you do online. Nobody calls HTTPS a criminal enabler. People just trust it, without knowing what argument it had to survive to get there.

That is the actual track record of this objection. It has been raised against every privacy and security advance that mattered, strong encryption, Tor, VPNs, and it has been technically correct about the fact every single time while being wrong about the conclusion every single time. Yes, it helps bad actors. It has never once followed that this is a reason to take it away from everyone else.

The comment under that post was not wrong. Privacy tools are effective for criminals, the same way locks, doors, and silence are.

What it left out is the only part that matters. Effective for criminals is true of everything that actually works. The real question is who is left standing in the room once you take the tool away. It is rarely the criminal. The criminal already left through a door you cannot see. It is everyone else, the ordinary, the careful, the quiet, standing there with nothing to hide and somehow less protected than they were five minutes ago.