Security as a Commons.

Ten years ago, putting a padlock on a website cost money and patience. You bought a certificate from a commercial authority, pasted files into a server config, and set a calendar reminder for the renewal you would probably forget. Large companies had people for that. A food bank, a local council's events page or a two-person newsroom usually did not, so they ran on plain HTTP and hoped nobody was watching the network.

That changed because a small nonprofit decided certificates should be infrastructure, not a product. Let's Encrypt entered public beta on December 3, 2015, and from that day invitations were no longer needed to get free certificates. It describes itself as a free, automated, and open certificate authority run for the public's benefit by the Internet Security Research Group (ISRG). Anyone who owns a domain can get a trusted certificate at zero cost, software on the server can request and renew it without a human in the loop, and the issuance protocol is published as an open standard that others can adopt.

The numbers that followed are hard to argue with. When Let's Encrypt launched, 39.5% of page loads on the web used HTTPS, as measured by Firefox Telemetry. Six months later it was 45%. In ISRG's 2025 annual report, the executive director writes that "in many parts of the world, over 95% of all page loads are encrypted," and that over the past year Let's Encrypt went from serving 492 million websites to 762 million. The same report says it has issued over seven billion certificates in ten years. ISRG is careful not to claim all the credit for the shift, and it shouldn't. But the Let's Encrypt homepage now puts the figure at more than 700 million websites. For every one of them, the hard part became free and automatic.

The point we care about is who those websites belong to. A certificate from Let's Encrypt is the same certificate whether the domain belongs to a ministry or a neighbourhood association. There is no premium tier with better cryptography. When a security capability is published as open source and run as a shared service, it stops being a privilege of organizations with security budgets. It becomes something you get by default.

Encryption on the web is the clearest case, but it isn't the only one.

Private messaging went the same way. The Signal Protocol is open source, and in April 2016 Open Whisper Systems announced that its integration into WhatsApp was fully complete, covering messages, group chats, attachments, voice notes and calls. In their words, over a billion monthly active users were now using "a modern, open source, forward secure, strong encryption protocol." A clinic coordinating with patients over a messaging app, or a tenants' group organizing on a phone, got end-to-end encryption without anyone in the room knowing what forward secrecy is.

Anonymity followed a similar path. Tor is, in the words of the Electronic Frontier Foundation's guide, a volunteer-run service that provides both privacy and anonymity online, released under free software licenses and used to get around censorship in a number of countries. The network exists because volunteers run it, and it is available to a human rights researcher on the same terms as to anyone else.

For journalism, the shared tool is SecureDrop. It is an open-source whistleblower submission system that media organizations can install, maintained as a project of Freedom of the Press Foundation and licensed as free and open source software. The project began with Kevin Poulsen and the late Aaron Swartz, and by 2016 it was in use at over thirty news organizations. Today the public directory lists 24 instances, and the range is the interesting part: the New York Times and The Guardian sit on the same list as Greekleaks, run by the investigative network Reporters United, and two independent journalists who run their own. A source reaching a freelancer gets the same submission system as a source reaching a national paper.

Even the plumbing is moving this way. WireGuard is meant to be implemented in very few lines of code and easily auditable, with its kernel components under the GPLv2. Linux 5.6, released on March 29, 2020, shipped it in the mainline kernel, and its author noted at the time that kernels from then on would have WireGuard built in by default. A municipality connecting two offices no longer has to buy a VPN appliance to get a modern, auditable tunnel.

Now the less comfortable part. None of this is free in the sense of costing nothing. It is free at the point of use because someone else is paying. ISRG's annual report describes an organization funded by charitable contributions, and its unaudited figures for January to October 2025 break revenue down as 40% sponsorships, 24% grants, 23% contributions, 9% Divvi Up and 4% interest and dividends. Its board includes people from Cisco, Amazon Web Services, OVHcloud and Mozilla. Signal, also a nonprofit, estimated that by 2025 it would need about $50 million a year to operate, supported by donations including an initial loan from Brian Acton. Tor depends on volunteers running relays.

Where Let's Encrypt's parent gets its money

• Sponsorships 40%
• Grants 24%
• Contributions 23%
• Divvi Up 9%
• Interest and dividends 4%

ISRG revenue, January to October 2025, unaudited.

That is a real dependency, and it deserves to be stated plainly. The protection a small newsroom gets from these tools rests on a handful of nonprofits keeping their sponsors, their grant renewals and their volunteers. If a major sponsor walks away, a 700-million-site service doesn't get to cut a feature. It has to find the money or degrade. We wrote about how that funding gets assembled in who funds the digital commons, and the security commons is the sharpest version of the same question, because the cost of failure lands on exactly the organizations that could never have afforded the paid alternative.

There's a second dependency too. These projects are open source, so anyone can inspect them, but inspection isn't the same as being inspected. A shared service is only as strong as the code and the dependencies underneath it, and the organizations relying on it mostly have no way to check.