One of the most bizarre intelligence coups in recent memory was quietly hailed by law enforcement organizations worldwide in 2021. Under the pretense that the phones provided true end-to-end protection, the FBI had been running a phony encrypted phone platform dubbed ANOM for a number of years, distributing the devices through criminal networks. They didn’t. All communications went via FBI servers. By the time the operation came to an end, it had resulted in arrests in over a dozen nations and the seizure of cash, guns, and drugs in amounts that made headlines for weeks.
Practically speaking, the operation was a huge success. From a different perspective, it was also a clear example of why the encryption argument is so genuinely challenging: the FBI won that round by creating a trust system that was so persuasive that targets freely opted to use it, rather than by cracking encryption. That approach isn’t scalable.
As a technique, end-to-end encryption guarantees that a message can only be read by the sender and the intended recipient. There isn’t a middle server. No service provider has a copy. A judge cannot be given a key. Years later, investigators are still figuring out how the architecture of digital communication changed when WhatsApp introduced default E2EE or when iMessage became the norm for hundreds of millions of iPhone users. The FBI refers to it as “Going Dark.”
The metaphor is appropriate. When a legitimate court order is sent, lawfully obtained, and properly served, the corporation that receives it is really unable to comply because the decryption key is only available on a device that is not under its control. The warrant in an investigator’s hand is theoretically useless against the evidence, which is encased inside glass and aluminum in a suspect’s pocket.
Law enforcement agencies also rely on encryption, which is a difficulty that they are frequently reluctant to publicly acknowledge. Encrypted communications are used by police departments to safeguard operational security. It is used by intelligence services to protect undercover operatives’ and informants’ identities from international surveillance.
A victim of domestic violence could be shielded from a stalker monitoring her phone or a journalist working in a nation with a hostile government from having their sources exposed by the same mathematical principles that enable a drug cartel to coordinate without leaving a trace. These are not fictitious usage situations. Thousands of individuals deal with them on a daily basis, and weakening the underlying technology to address the Going Dark issue will concurrently and equally affect them.
Proposals for “exceptional access”—a system that permits authorized law enforcement to access encrypted communications under judicial supervision—have been made by governments in an attempt to thread this needle. It has been discussed in the EU. Legislation has been pushed in that direction by the UK. Since the Clipper Chip era in the 1990s, which failed and was mostly forgotten until the smartphone made it important once more, the US has addressed the topic in a number of ways.
The same technical argument has been used repeatedly by security researchers and cryptographers to refute these proposals: it is impossible to create a system with a backdoor that is only accessible by authorized people. Either the backdoor is secure, making it accessible by anybody who discovers it, including hostile nation states conducting their own intelligence operations, or it isn’t actually a backdoor. Between the two viewpoints, there is no middle ground in cryptography.
Investigators have created genuine and sometimes successful workarounds. Even when content is unavailable, metadata—who communicated with whom, when, how long, and from where—remains accessible and can be used by knowledgeable analysts to make insightful deductions. Physical device forensics has yielded evidence in significant convictions by extracting data from unlocked or vulnerably configured phones using commercial technologies.
ANOM and other undercover operations can occasionally be quite successful. However, none of these strategies address the entire extent of the issue, and observing this discussion recur in legislatures every few years gives rise to the perception that the underlying conflict will not be resolved by legislation. The decision has already been made by maths. How long it takes for everyone else to accept their decision is the question.
