There are already severe criminal penalties, the issue is its impossible to enforce except in retrospect in most cases. The attack surface is extremely porous b

There are already severe criminal penalties, the issue is its impossible to enforce except in retrospect in most cases. The attack surface is extremely porous because of money-printing with the government as a customer and every major company lining up to the trough. For an example, its quite well known you can do a lot with an off the shelf SDR. Technically those receivers can capture cell phone signals and other data passively. It would be almost trivial to set up an overlay network in target regions, its not much harder than putting together a local LAN/point to point connection. There is no indicator its happening because its not active. This also applies to collectors that operate on TEMPEST principles (i.e. the emissions from your device displays). Active MITM poses worse outcomes, but not strictly needed for these things. Encryption prevents most of this, if its secure but security comes from the visible industry, and visible industry lags behind where the landscape actually is. There are companies and nations who put satellites in orbit that collect this data who may offer it as a service. Technically you can passively collect any raw signals with an appropriate length of wire for an antenna so there isn't much of a manufacturing bottleneck authorities could exploit. Without immediate and existential level of consequence, no criminal penalty will ever be enough. Incarceration isn't an existential consequence. The laws in effect only keep the honest people honest, and equally punish honest people for pointing out the emperor has no clothes.