Switzerland is running two surveillance projects on separate tracks. One is a statute, the Intelligence Service Act (NDG) revision, which Parliament is now finishing. The other is an ordinance, the revision of the post and telecommunications surveillance rules (VÜPF), which the government has frozen. They are often discussed together, but they are not the same instrument. The NDG vote does not decide encryption policy. Read side by side, though, the two show how Swiss lawmakers respond to civil-liberties and industry objections.
What the Council of States did
The Council of States took up the NDG revision (business no. 26.021) on 16 September 2026, according to the Defence Department's parliamentary tracker, after the National Council's debate on 3 June. I could not verify the vote tally reported to us (41–1, with 2 abstentions) in any official source, so this article does not rely on it.
The parliamentary record does show where the chambers ended up. The National Council's security committee (SiK-N) said on 13 October that it would follow the Council of States on three points. One is deleting Art. 5 para. 6 let. c, which would have let the intelligence service collect and process information on the political activities of organisations or persons. The committee backed that deletion 14–10 with one abstention. Nine articles are still disputed in the reconciliation stage.
The committee also voted 17–8 to back the Council of States' version of Art. 74, the power to ban organisations. Under that version Switzerland decides for itself which organisations threaten its security, without relying on the political assessments of international bodies.
The strongest case for the law
The case for the bill is serious. Intelligence services say they cannot counter violent extremism or foreign cyber operations with tools written for an earlier era. The NDG extends the mandate to cyberspace. Art. 37 paras. 3–4 cover urgent intrusion into computer systems abroad, and the Council of States wanted the heads of the Foreign Affairs and Justice departments informed alongside the defence minister. The SiK-N rejected that tightening 16–8, calling it impractical for urgent cases. Reasonable people can differ on how quickly such an operation must move.
Where the proportionality problem remains
Dropping political-activity collection is a real win for free expression and association, because it removes the most direct route from intelligence work to monitoring lawful dissent. The remaining concerns are narrower but still matter.
The organisation-ban power depends on security assessments that the public and the affected group cannot test. Banning an organisation is among the most serious acts a state can take against association rights. Where the evidence is confidential, the safeguards have to be procedural: independent review, a duty to give reasons, and a time limit. The SiK-N also rejected, 19–0 with six abstentions, an immediate rule on professional secrecy (Art. 44a), saying it would effectively halt radio and cable reconnaissance. It pointed to a later NDG package. Journalists and lawyers are left waiting for protection that has been deferred.
A proportionate approach would pair the broader mandate with sunset clauses, published oversight statistics, and a requirement that the independent oversight body's recommendations be followed. The committee voted 14–11 against the exception that would let the defence minister waive those recommendations (Art. 78b), which is the right call.
The encryption question sits in a different instrument
Encryption policy is set in the VÜPF ordinance. On 11 February 2026 the Federal Council took note of the consultation report. The justice department commissioned an external regulatory impact assessment of the economic effects on affected companies. A second consultation is planned once a final draft is ready, with no date given. Two parliamentary motions (25.4206 and 25.4273) instruct the government to rework the drafts and consult again, and the Federal Council recommended adopting both.
The proposal's critics have been vocal. Blick reported in May 2025 that Proton's chief executive, Andy Yen, said the company would move its headquarters abroad if the government forced compliance. The same report says Threema did not announce a departure, and called the government's claim that little would change "schlicht falsch" (simply false). Blick also reports that the draft would require providers to remove certain encryption, such as transport encryption, while explicitly excluding end-to-end encryption used by messengers. The line between those categories is where the dispute lies. Providers argue that any duty to strip encryption they apply weakens the trust their products sell. The government says the draft leaves end-to-end encryption alone.
That disagreement is a reason to keep the ordinance on hold until the impact assessment is public. Switzerland's privacy-tech sector sells jurisdiction as a product. A rule that sounds narrow in the ministry can look broad to a customer comparing providers.
What to watch
- Reconciliation: The Nine open NDG articles must be settled between the chambers. The cyber urgency procedure and professional secrecy are the live fights.
- The impact assessment: Whether the VÜPF revision is narrowed before a second consultation, and whether the text states in the ordinance itself that end-to-end encryption is out of scope.
- Safeguards over scope: Courts and oversight bodies matter more than the mandate's wording. A broad mandate with strong, independent review is better policy than a narrow one with none.
The NDG outcome is cautiously encouraging for free expression: lawmakers listened and removed the clearest overreach. The VÜPF is the unfinished test. A government that is willing to trim political-activity surveillance should be willing to write the end-to-end encryption carve-out into binding text, which is what its own stated position implies.