The Digital Iron Curtain Gets Its Root Certificate
On June 4, 2026, the Internet Security Research Group (ISRG), the non-profit parent of Let’s Encrypt, quiet-dropped version 1.7 of its Subscriber Agreement. Let’s Encrypt is the engine that single-handedly dragged the modern web into the HTTPS era, securing over 200 million active domains at zero cost and driving the encryption rate of the global web past 90 percent. But its new terms draw a sharp, legalistic border across the global network. Under Section 3.1, users must now warrant that they are not “located in, organized under the laws of, or ordinarily resident in any country or territory that is the target of comprehensive U.S. sanctions,” nor owned, controlled, or acting on behalf of anyone who is. It is the end of an era: the default, open, friction-free security layer of the internet has officially conceded to the realities of U.S. export control.
Let’s Encrypt was founded on a simple, universalist premise: encrypting the web is a basic civil and cryptographic requirement, akin to paving roads or providing clean water. By automating certificate issuance via the ACME protocol, it took TLS out of the realm of premium commercial products and made security a utility. However, the updated subscriber agreement highlights the inescapable gravity of national jurisdiction. As an entity organized as a 501(c)(3) in California, ISRG is directly bound by the Treasury Department’s Office of Foreign Assets Control (OFAC) regulations. While commercial Certificate Authorities (CAs) like DigiCert and Sectigo have long maintained explicit blacklists of sanctioned countries (such as Cuba, Iran, North Korea, and Syria), Let’s Encrypt had historically operated under an automated domain-validation model that stayed clear of formal user identity attestation. Codifying these strict terms directly into the core agreement marks a pivot from a borderless global utility to a legally guarded domestic actor.
The technical community has greeted the change with a mixture of pragmatic resignation and deep ideological alarm. The paradox is biting: the populations most in need of secure, eavesdrop-proof communications are precisely those living under authoritarian, US-sanctioned regimes. In countries like Iran and Syria, where state censors regularly deploy deep packet inspection (DPI) and domestic monitoring, TLS encryption is not a commercial luxury—it is a vital shield for activists, journalists, and ordinary citizens. Depriving domain operators in these regions of trusted certificates makes local traffic vulnerable to state-sponsored man-in-the-middle (MITM) attacks. On Hacker News, community members pointed out the self-defeating nature of the policy. User Insimwytim argued: “Iran is blocking internet for months, US …bans creation of secure connections - that’ll show ‘em! Russian quasi-government structures are spending quadrillion of rubles on a TSPU (censorship system) to spy on Russian residents, US …helps them by making snooping on what is currently encrypted traffic possible by banning accessible encryption!”
This shift accelerates the logical balkanization of the internet—a process that has been steadily building for a decade. If the Western-backed root of trust can be denied by geopolitical decree, non-aligned states have no choice but to build their own parallel security architectures. We are already seeing the emergence of state-run Certificate Authorities in Russia and China. Because these domestic roots are not accepted by major Western browsers like Chrome, Firefox, and Safari, users in those countries are forced to install government-issued root certificates to access basic domestic services. This effectively hands authoritarian states the master keys to decrypt and inspect all domestic traffic, completely undermining end-to-end security.
While ISRG’s legal counsel undoubtedly had no choice but to align the subscriber terms with OFAC’s increasingly expansive interpretation of “exporting services,” this update serves as a bleak reminder of a fundamental truth: the “global” cloud is a legal fiction. True neutral infrastructure cannot exist when its servers, bank bills, and board of directors are located within a single superpower’s borders. Just as the RISC-V Foundation relocated to Switzerland in 2020 to preserve the neutrality of open-source silicon, open security projects face an existential choice. They must either find a way to decouple their structural operations from the reach of Washington’s long-arm jurisdiction, or accept that they are not securing the web—they are securing the empire’s slice of it.