VPNs are now in the crosshairs of the European Union, according to a recent report by an EU expert group. The latest report from High-Level Group (HLG) branded VPNs (Virtual Private Networks) as one of the leading “key challenges” for law enforcement in their efforts to investigate crimes.

The EU Council tasked this group of experts three years ago with coming up with a strategic plan “on access to data for effective law enforcement.”

HLG has always considered encryption an issue and argued that it sometimes makes it “impossible for law enforcement to access the content they need.

“Data cannot always be read due to encryption. Many services now use end-to-end encryption to protect confidentiality of communication, privacy and cybersecurity, but this can make it extremely difficult for law enforcement to access communication data. This means that even if data is intercepted legally, it is often impossible to decode it. Without the ability to read this data, important evidence remains hidden, making it much harder to investigate crimes,” the report explains.

In the past, concerns about encryption were mainly focused on secure email services and messaging apps.

The group’s most recent report added VPNs into the mix.

“Encrypted devices and apps, new communications operators, Virtual Private Networks (VPNs), etc. are designed to protect the privacy of legitimate users,” the report reads. “But they also provide criminals with effective means to hide their identities, market their criminal products and services, channel payments and conceal their activities and communications, effectively avoiding detection, investigation and prosecution.”

It’s worth noting that at the same time, the EU report does acknowledge that encryption is really important for keeping people safe from serious privacy and security issues, like foreign spying, hackers, and cybercrimes. The problem, though, is that there doesn’t seem to be a simple balance between protecting privacy and giving law enforcement the tools they need to investigate crimes.

For now, it’s unclear how EU lawmakers will manage to balance the need to access people’s data, even if it’s encrypted, all while keeping data secure and private.