Going Dark, and the era of law enforcement hacking

8/14/2026 at 10:50:03 PM

It's worth realizing that, before computerized central offices, telephone wiretapping required running physical wires. Back when Rudi Giuliani was prosecuting organized time, not only did physical wires have to be run, the cops were billed for them as expensive private lines. His task force was spending about a million dollars a year with New York Telephone on wiretapping. In one case, law enforcement didn't pay their bill, resulting in the person being wiretapped having the wiretap connection show up on their bill, blowing the case.

That resulted in the Communications Assistance to Law Enforcement Act, which mandated that central offices offer remote wiretapping. Capacity up to 1% of lines is required.

Back in the electromechanical era, the only call data that could be collected was outgoing dial pulses, using a "pen register".[1] (The one shown in Wikipedia is mine. It's a beautiful piece of antique brass telegraph technology. It records dial pulses as dashes, and has to be wound up like a clock, with a big brass key.) The Supreme Court decision allowing "pen registers" without a warrant refers to these "extremely limited" devices. That definition has been stretched and stretched by law enforcement into all non-voice data collected by telcos.

Law enforcement still wants more.

[1] https://en.wikipedia.org/wiki/Pen_register

by Animats

8/15/2026 at 12:12:58 AM

> In one case, law enforcement didn't pay their bill, resulting in the person being wiretapped having the wiretap connection show up on their bill, blowing the case.

In the fictional world of The Wire, one of the "wires" were blown when the guy checked on his mobile bill to find out his account was flagged to not be disconnected. I'm sure this was art imitating life or inspired by type of thing

by dylan604

8/15/2026 at 12:33:10 AM

The Wire is allegedly one of the more realistic crime shows in how incompetent it portrays the police.

by inigyou

8/15/2026 at 4:53:05 AM

It was created by a journalist and a cop, who both had long careers in Baltimore before working on the show. Not surprising how realistic it is. (Also a beautiful work of art beyond the realism.) If you find the show interesting, David Simon's book "Homicide" is a great read.

by thisoneisreal

8/15/2026 at 8:17:39 AM

And a few of his other series, such as Treme, The Deuce, and Generation Kill are all fantastic.

by pimeys

8/15/2026 at 11:40:20 AM

"The Corner" is also a great read by him.

by mrbombastic

8/15/2026 at 2:13:01 AM

In their defense their target was amazingly adept.

Many criminals even today don't engage in basic counter measures like you see on that show.

And I'd call them "dysfunctional" more than inept. Bad leadership stymied by political goals overcomes even good policing.

by newsomix9xl

8/15/2026 at 1:34:04 PM

Criminals with competence still operate in big numbers today, but LE very rarely targets them. The soft targets are just so abundant and easy, and the LE incentive system does not reward choosing hard targets at all.

Doesn’t help that a big chunk of the competent criminals have fully or partially internationalized their operations which acts as a very strong shield against LE.

by Lord-Jobo

8/15/2026 at 6:16:18 PM

Indeed that was one of the tropes of The Wire: the "street rip" bust was preferred over real investigation work that they police wanted to do. However the street busts yielded immediate (misleading) metrics of action and public photo ops: patient investigative work didn't.

The politicians wanted the immediate appearance of effectiveness over real effectiveness, top police brass wanted to keep their jobs, and rank and file police got to do ineffective work that made little difference.

by newsomix9xl

8/15/2026 at 5:34:36 PM

"According to political scientist Marie Gottschalk of the University of Pennsylvania, since the 1970s while the prison population of the United States was rapidly increasing as the U.S. was targeting mostly poor and working class people by harshly punishing street crimes, drug crimes and immigration offenses, there was a simultaneous mass deregulation and decriminalization of white collar and corporate crime "despite a tsunami of elite-level criminal activities by leading banks, accounting firms and major corporations." Sociologist Loïc Wacquant writes that during this time period neoliberalism has not shrunk government but instead set up a "centaur state" with little governmental oversight for those at the top and strict control of those at the bottom."

https://en.wikipedia.org/wiki/White_collar_crime

by leonidasrup

8/15/2026 at 6:22:27 PM

This is a very high level "class war" analysis by academics that suggests that the poor are being oppressed while the rich go free.

It's a nice morality tale, and I'm sure there are instances where it is absolutely true. But that it is true as a rule, or even that they are comparable levels of analysis (one are "white collar" crimes and the parallel would be "blue collar" crimes, no? But street crimes and immigration offenses aren't working mans crimes - these are "no collar" crimes: anyone can commit an immigration offense, even rich people. And street crimes are often drug driven.

This analysis by Gottschalk and Wacquant suggests a "conspiracy" tone within a class war context. I would want to know if they didn't have some class war bias in their analysis before I accept their analysis from authority without examination.

by newsomix9xl

8/15/2026 at 3:23:56 PM

[dead]

by cindyllm

8/15/2026 at 1:31:39 PM

Digital forensics examiner here; it’s extremely accurate especially for the tech involved at the time. I think I spotted a very small handful of things it had to kick under a rug for the plot to work, which is unbelievably small for a show like that.

It’s easily the best LE show that exists, but not just because of its accuracy; it’s incredible in its pure honesty. Some of the cops are total worthless shit bags, worse than the best of the criminals easily. Allowing that overlap, one that exists in real life, injects a whole lot of nuance into the story that is basically nonexistent outside of the show. And allows characters to grow and improve. It takes writers with actual LE experience (which they had) and a lot of talent to write that kind of thing without totally blowing it.

by Lord-Jobo

8/16/2026 at 12:46:03 AM

I’m interested in forensics, is it worth getting a cert? I barely see jobs show up on USAJOBs in the Bay Area, do you have any recs on finding roles?

by leoqa

8/15/2026 at 1:09:40 AM

You’re doing my boy McNulty dirty.

by semiquaver

8/15/2026 at 3:44:03 PM

At least they’re not drinking Protestant whisky

by Henchman21

8/15/2026 at 4:19:07 PM

That's the kind of thing that makes you wake up in the wrong town.

by dylan604

8/15/2026 at 5:29:44 PM

Perspective shift: whether positive or negative, have there ever really been any unapproved, rogue media portrayals of law enforcement?

by fitsumbelay

8/15/2026 at 11:11:59 PM

"Training Day"

by Animats

8/15/2026 at 2:09:33 AM

That, and the alcoholism

by walrus01

8/15/2026 at 1:11:50 PM

Or that bit wasn’t true to begin with.

The billing accounts never would have crossed the same desk,

let alone been crossed.

The lines also weren’t terminated at the suspects’ homes. So, again, no vector for the bill to be sent there.

I’d lean towards “myth” on that - until a more convincing story appears.

by DANmode

8/15/2026 at 5:21:58 PM

https://en.wikipedia.org/wiki/Observer_effect_(physics)

by TZubiri

8/15/2026 at 9:08:54 AM

Never watched the wire...but I remember back 25+ years ago some people joking about not paying their phone bill to see if the phone was tapped.

They claimed that since it never got shut off when they didn't pay it must be tapped.

Possibly correct I suppose...

by Ccecil

8/15/2026 at 5:40:52 AM

The cost dynamics have flipped in the past decades. What we have now is "Surveillance Too Cheap to Meter" https://cacm.acm.org/practice/surveillance-too-cheap-to-mete... Because storing data is cheaper and often economically more useful than not storing it.

by vaylian

8/15/2026 at 7:31:04 AM

With the price of memory skyrocketing, maybe that equation changes slightly.

by 20after4

8/15/2026 at 11:54:44 AM

the $/gb of storage is declining, which is more relevant here.

The big boogeyman that noids have insisted on for the past ~30 years is that intel agencies are saving everything they can to try and decrypt it later. Thankfully for us, the rate at which internet traffic grows year over year massively outpaces the global production capacity of spinning rust.

The last time I did this napkin math I think the collective global production was barely enough for some small fraction (maybe 1/8th or 1/12th) of everything.

It isn't exactly something that can be done in secret. Everyone else has to buy hard drives too, there are only so many sources of raw materials, places that can refine them, etc

E: I think the most relevant thing to avoid if this is a concern for you would be commercial VPNs. There's a reason fiveeyes doesn't want them to be banned. They can almost assuredly save piles of money by simply coercing providers into allowing them physical access to leverage side channel attacks

by monster_truck

8/15/2026 at 3:10:23 PM

Declining? Not when I try to price out 10tb drives. I'm sure the economics will catch up eventually, but anyone shopping for hard drives is getting a shock.

by xhkkffbf

8/15/2026 at 3:18:29 PM

It's 2026 dude, buy the 28tb drives.

by monster_truck

8/15/2026 at 3:59:18 PM

The 10TB drives right now cost as much as the 20TB drives I bought a year and a half ago for my NAS.

by m-p-3

8/15/2026 at 4:43:33 PM

That will be 1100 bucks, lol

by vardalab

8/15/2026 at 6:32:37 PM

$150 if you buy LTO-9 cassettes. Probably much cheaper when bulk purchased too

by IncreasePosts

8/15/2026 at 6:30:53 PM

Not to nitpick but the feds would be archiving this stuff on tape, which is 10x or more cheaper than hdds per TV when factoring in failure rates

by IncreasePosts

8/15/2026 at 2:40:16 AM

> The one shown in Wikipedia is mine.

neat!

https://upload.wikimedia.org/wikipedia/commons/e/e3/Pen_Regi...

assuming you still have it, it wouldn't be the worst idea to update the pic to something without chromatic aberration and motion blur. the wiki pic is probably the worst of the bunch compared to others on google image search :)

by leeoniya

8/15/2026 at 5:43:41 AM

If any legit museum, or attorney involved with Fourth Amendment issues, would like it, please contact me at nagle@animats.com. It's just sitting around.

I bought it on eBay years ago, out of curiosity, and fixed it. I built a little control box to go with it, with a phone dial and a 9V battery, and found a source of paper tape and ink. So it can be demoed. If it ever is used in a court appearance or legislative testimony, that would be better than it sitting in a box.

by Animats

8/15/2026 at 5:06:31 AM

Yeah I find the phone-taken images much worse than camera-taken even despite the astonishing number of megapixels and amount of technologies promised in the phones nowadays. Sadly most people don't buy the camera because it's too expensive and you need prepare yourself to take it with you (so the most photos are taken instantly with the phone)

by p0w3n3d

8/15/2026 at 3:42:58 PM

> https : / / upload.wikimedia.org / wikipedia / commons / e / e3 / Pen_Register.jpg ? utm_source=commons.wikimedia.org & utm_campaign=index & utm_content=original

I was nerd-sniped by the above link (which I've added spaces to, to keep it from being truncated) and thought "Huh, since when does Wikimedia Commons use tracker barf?" So I found the page for this image:

https://commons.wikimedia.org/wiki/File:Pen_Register.jpg

then copied the full-size image's link... and sure enough. I guess they want to keep tabs on sites that hotlink their images and don't even practice good link hygiene.

by urbnspacecowboy

8/14/2026 at 11:38:03 PM

"Back when Rudi Giuliani was prosecuting organized time" I can't even fathom he'd not be cashing checks from the mafia to go after other families. Odds are good that historians will find that he did.

by downrightmike

8/14/2026 at 11:48:48 PM

He traded Italian organized crime for Russian organized crime.

by ericjmorey

8/15/2026 at 1:26:12 AM

[dead]

by usumgallu

8/15/2026 at 12:24:03 AM

A similar story around this is the controversy around various Mumbai “encounter specialists” (a violent incident between police and gangsters is an “encounter”) and whether they were effectively hitmen for some faction of the local mob. Always thought it was quite intriguing stuff.

by arjie

8/15/2026 at 5:19:04 PM

>using a "pen register".[1] (The one shown in Wikipedia is mine.

Any idea of museums that may hold historical pen registers (or paraphernalia) for public viewing?

by TZubiri

8/15/2026 at 7:17:23 PM

There's one in Tempe, AZ that has a 1980s "Dialed digit recorder", but that's a much later microprocessor controlled unit.

The mechanism is that of a "Morse inker", a recorder used to receive telegraph signals. Here's one that's part of a Siemens telegraph set from 1862 or so.[1] The wiretapping version is the receive part of a telegraph set made portable in a nice wooden box with a carrying handle.

All this shows how rare wiretapping once was. Law enforcement had to use repurposed antique telegraph equipment.

[1] https://collection.sciencemuseumgroup.org.uk/objects/co32910...

by Animats

8/14/2026 at 10:09:26 PM

> In the real world, it does feel likely that we’re going to hit some sort of a ceiling on the number of useful bugs, and probably we’ll hit it soon.

This doesn't resonate with me. I see companies adding more sloppily written features with AI. I see more bugs in the software I use, not less. While it's plausible that software is getting both buggier and more secure, I suspect those two move in the same direction not opposite.

My guess is that we're getting better at finding _existing_ security issues with AI (and thus fixing those issues), but simultaneously adding more insecure surface areas _at a faster rate_.

by mbroshi

8/14/2026 at 10:35:09 PM

One way to resolve the tension here is to note that CNE and lawful-intercept access to phones depends generally on platform vulnerabilities, not application code vulnerabilities. Low-level platform code churns less, absorbs more fixes under AI workloads than it does new features, and works in a constrained space where guardrails are easier to provide (and where those guardrails already have institutional support at Apple and Google).

Over the long term this state of play could change, and IC/LEO organizations could start leaning more on application vulnerabilities than on platform RCEs. But the action would probably still coalesce around a couple of app-layer targets that could themselves be hardened.

by tptacek

8/15/2026 at 6:13:20 PM

Lawful-intercept is in general implemented at the server equipment of telecom operator, not in the phones. In general, intelligence services don't access phones, if the interception can be done at the operator, because this could alert the subject or expose their techniques.

According to a friend, who is working for an telecom company in Europe, Lawful-intercept is done at a server rack provided by and managed by a law enforcement agency, all traffic of this telecom company is copied to this server rack. The server rack also has a second direct connection to the law enforcement agency. Employees of the telecom company don't know which phone numbers are targeted or which traffic is intercepted.

by leonidasrup

8/15/2026 at 4:10:37 AM

I was hoping that the basebands and firmwares would get formally verified. Maybe they will ... with AI-written proofs!

by schoen

8/15/2026 at 5:09:25 PM

Eh, we’ve seen many footholds of documented chains start in application code throughout time.

To list a few: - WebKit (CVE-2016-4657) - WhatsApp (CVE-2019-3568) - Chrome (CVE-2021-38003)

Then, also the distinction between platform vs application gets fuzzy with bugs in PassKit etc.

by hashstring

8/15/2026 at 5:28:27 PM

WebKit and Chrome are platform codebases. WhatsApp is an example of what I'm talking about, though.

by tptacek

8/15/2026 at 11:45:14 AM

> My guess is that we're getting better at finding _existing_ security issues with AI (and thus fixing those issues), but simultaneously adding more insecure surface areas _at a faster rate_.

This does seem to be true in the vibe coding era, which I expect will implode at some point. But LLMs could certainly lead to a future where vulnerabilities are scarce. The best time to vet security factors is designing the model and writing the initial code, and LLMs are extraordinarily useful for this too. Most code with security implications is not written by a security expert.

An LLM can be the most anal and well informed security expert you can find. If you write the code yourself but have one in the loop from the start, the code will be in much better shape.

by doginasuit

8/14/2026 at 10:13:19 PM

I don't know, my colleague refuses to use AI and I've been seeing more bugs from their side, while reducing bugs on my side with the help of AI.

That said if companies want to "ship ship ship fast", then yes even AI can produce bugs or regressions if not carefully reviewed by the human.

by aleksandrm

8/14/2026 at 10:18:31 PM

I don't have any colleagues like that anymore, but even as far back as the last half of 2025 I was seeing that automated AI review was becoming effective enough that I considered it essential to any project where security was a serious concern.

These days we're generating multiple times more code than we were writing before. That means a similar multiple of opportunities for bugs to be introduced - so the ability to automate security review is more impactful in proportion to that.

by Ancapistani

8/14/2026 at 10:16:26 PM

> I've been seeing more bugs from their side, while reducing bugs on my side with the help of AI.

You should question your ability to see any bugs on YOUR side.

by bossyTeacher

8/15/2026 at 3:39:41 AM

> while reducing bugs on my side with the help of AI.

How do you know? You might be adding (latent) bugs every time your LLM fixes one for you.

by kelnos

8/15/2026 at 6:38:14 AM

Same as usual: add tests. Over time the test suite becomes the spec that describes how the software should function. As the test suite grows you squeeze out room for undefined behaviour and bugs.

by remus

8/15/2026 at 12:45:09 PM

>Same as usual: add tests. Over time the test suite becomes the spec that describes how the software should function.

That covers functionality - it doesn't catch the kind of bugs talked about in TFA.

by coldtea

8/15/2026 at 5:25:54 PM

I remember decades ago IBM published some research that said that every two bug fixes resulted in a new bug.

by tonyedgecombe

8/16/2026 at 4:39:44 PM

As long as the first derivative is negative, you can finish with a usable product.

If the first derivative is positive, adding people does not help.

by budman1

8/17/2026 at 9:18:48 AM

Yes, it just means your bug queue is twice as long as you think it is.

https://en.wikipedia.org/wiki/1/2_%2B_1/4_%2B_1/8_%2B_1/16_%...

by tonyedgecombe

8/14/2026 at 10:28:52 PM

Have you asked your colleagues what it’s like to deal with your code?

by Forgeties79

8/15/2026 at 12:04:55 AM

It's not 2025 anymore my friend.

by boc

8/15/2026 at 12:23:25 AM

Yet apparently people still dump unvetted LLM outputs onto their colleagues and expect them to thank them for the privilege. So it’s worth asking them what the consensus is of their work to find out if it’s the case.

by Forgeties79

8/15/2026 at 4:46:56 AM

That's the old way. The current way is nobody reviews anything. The LLM reviews it all and nobody even reads it, they just click approve, and merge blindly. I wish I were kidding.

by leptons

8/15/2026 at 1:13:13 PM

> nobody

Speak for your workplace only.

Most places still consider a PR or commit yours, if your name is attached.

Act accordingly.

by DANmode

8/15/2026 at 4:07:44 PM

>Act accordingly

I've been looking for a new job where people aren't so reckless... the AI psychosis is heavy at my current job.

by leptons

8/15/2026 at 10:18:29 AM

Not where I work. We have both review PRs.

by mlrtime

8/15/2026 at 11:41:50 AM

The point is that people who want to be secure can be more secure than ever while people who don’t care about security will be less secure than now.

Author claims something slightly different but that’s how I would look at it.

The extremes are more potent because either you get super secure 10 times vetted system or you get underpowered model slop with all the vulnerabilities it entails.

by juleiie

8/14/2026 at 10:29:29 PM

Disagree, and in a way it feels like we are dealing with inverse issues: the security "skill" is well defined and will be also engaged with by an agent. Communication companies are further incentivized as any failure is at best reputational harm. Meanwhile SaaS companies are not strictly required to have good UX for their human end users, largely because those users will likely work around the issue. also network effect vs low costs of switching for for comms

by thinkthatover

8/15/2026 at 8:45:52 AM

> I see companies adding more sloppily written features with AI

I think this is a side-effect of the old product management process adapting to AI. We (as an industry) were never very good at defining features rigorously, because there was a smart human in the loop who had to implement the feature and could push back on sloppy definitions.

Whereas security bugs are easy for the LLM to define and fix.

by marcus_holmes

8/14/2026 at 10:28:18 PM

They’re not “bugs” they’re “quirks”! Our software is so quirky. It’s a feature!

by Forgeties79

8/14/2026 at 11:17:19 PM

Quirky and adorable!

by hollerith

8/15/2026 at 9:23:16 AM

My hot take is that AI is a multiplier. Software engineers skill can be measured on a scale from -10 to +10, where 0 means you introduce as many bugs as you solve, or something along those lines(this scale is loosely defined, don't think too much about it)

Any engineer who's skill value evaluates below 0 on my scale, ends up with a large negative number when they use AI. Anyone with a positive number ends up with a large positive number.

The extra bugs you're seeing are from devs on the wrong side of 0 on my poorly defined scale.

by amarant

8/14/2026 at 9:59:27 PM

On one side, you have pieces like this, where seemingly there are constant fights between serious actors with large and properly distributed budgets, employing top tech and top minds; on the other - regular news of the hackz, where responsible person in charge of security with root access failed to grasp basic technical knowledge (several times), ticking every checkbox in "never do this" list from security best practices, which led to every customer being pwned.

It's like two parallel worlds, that exist in the same place at the same time, but somehow don't cross.

by Insimwytim

8/14/2026 at 10:10:10 PM

I started my career in the military, and got lucky enough that SOMEHOW, we convinced them to fund a trip to GDQ for educational purposes.

Anyways, while there I attended a little roundtable on software security. It was me, representing a small unit from the Air Force, some dude from Google, and like 15 game devs.

Despite only being a dev of 5 years at that point, I was SHOCKED at the lack of knowledge on software security. Even simple concepts seemed completely foreign to the game devs, though the Google dude seemed to have a really solid understanding of security.

Obviously game devs and website devs and all kinds of devs have different focuses, but it just blew my mind that out of all the topics there I might’ve been considered a comparative expert in, security was somehow the one. I wasn’t sure if that was a major plus for military devs or a major concern for the other devs, but now I’m starting to learn in the latter direction.

by kulahan

8/14/2026 at 10:26:57 PM

Without knowing when that was, I can't be sure how concerning it is.

As an end user, security in game development seems to hit a minimum is the early 2000s.

I recall playing EverQuest and using ShowEQ on a Linux machine on the same network as a proxy to silently eavesdrop on the traffic to show a map of the game with all the hidden/obscured/visible stuff all present. They either never encrypted that traffic or I quit playing before they did.

As multiplayer games started to become the default, netcode improved quite a bit and basic encryption was implemented - but I don't recall a single multi-player game, ever, that was free of hackers when playing online.

It feels like over the years the issue moved from remote exploitation to hiding processes on the user's machine. That has lead to kernel-level anticheat systems. I'm unsure of the effectiveness as when they started to become common I moved all of my gaming to dedicated hosts because I wasn't willing to give that level of access to my "real" computers. That said, I've certainly not noticed a decrease in the perceived number of cheaters.

These days, as far as I know - and to be clear, this isn't an area of deep interest for me - I'm not worried about my gaming accounts being compromised through technical means. It feels like that sort of security is a solved issue overall, although I suppose it's also possible that other forms of exploits have simply gotten easier/cheaper.

by Ancapistani

8/15/2026 at 7:23:00 AM

> It feels like that sort of security is a solved issue overall

...ish. The solution is false positives and a permanent underclass. You can't play those games unless you're on windows and you grant root to the anti-cheat.

I don't care much about that, but i do care about people being unemployable because some amorphous machine doesn't like the way they comb their hair.

Last century, if you grew up five to a room then at least you knew why you were marginalised. It wasn't just, but it was legible. Now, some of us are living in Terry Gilliam's Brazil.

by psd1

8/15/2026 at 2:01:00 AM

I've never seen an exploiter on Clash Royale.

by Cider9986

8/15/2026 at 1:40:59 AM

Security in the game industry is a sick joke. There are dozens of RCE riddled titles sold on Steam at this moment. For example, many past titles on "Call of Duty" series with CVE-2018-20817 [1].

BTW, I highly encourage all EU citizens to prepare Cyber Resilience Act complaints for September 11, 2026 when the law kicks in ;-)

[1] https://www.reddit.com/r/blackops2/comments/1v3xowq/just_ent...

by veeti

8/15/2026 at 3:28:54 AM

Absolutely crazy that these CVE-ridden CoDs are being sold by Microsoft itself!

by dave7

8/15/2026 at 5:10:13 AM

Crazy, but unsurprising.

by DANmode

8/15/2026 at 1:22:30 AM

Hah. It probably shouldn't be that surprising? Most engineers learn security on the job, not school. Game devs don't deal with -- and don't need to deal with -- the kinds of security issues Google and the military do.

Google has probably the best security team in the world, and they need to. The military deals with state actors by definition.

Gamedevs need to ship. I'm not saying they don't care about security, but short of some showstopper critical problem, it's not a thing and doesn't need to be.

It doesn't matter if your game is secure if nobody plays it lol

by habinero

8/15/2026 at 5:50:36 AM

Games are a different product altogether. Game developers want to have fun and create a fun experience. Security is almost always something they'd avoid if they could. They'd rather spend the time on more polish, juice or play testing.

Besides stopping cheaters, in almost all conceivable cases, security doesn't make a game better.

by magic_hamster

8/15/2026 at 4:05:58 PM

Other responses are an interesting juxtaposition. I would think "you can cheat in multiplayer games" is in a completely different category from "you can hack your opponent's computer in multiplayer games".

by zahlman

8/14/2026 at 11:37:24 PM

I think that's going to be the central tension of the next few years. The article suggests that software becoming more secure is going to lead to renewed calls for a "legitimate" backdoor for law enforcement to access everything about the device. Well, that security means nothing if someone phishes Kash Patel, something which has already happened. You go through the weak link, which is almost always the human.

I could see a future where the government is replaced by the software system which has the fewest security flaws, simply because it is the last thing left standing as everybody hacks everybody else. We end up with a Matrix-like or Terminator-like future where humanity now lives in service of the machines.

by nostrademons

8/14/2026 at 10:27:14 PM

K shaped economy and K shaped development?

by edoceo

8/15/2026 at 1:33:41 PM

[flagged]

by conmod278

8/15/2026 at 12:48:09 AM

I've always loved the ridiculousness of the "going dark" label when law enforcement can't access encrypted chats or a back door isn't built into a piece of software. When there are security cameras on the vast majority of houses, stop lights and in people's hands, and when so much meta data about people's associations are shared from Google, Facebook, any other social platform, how in the world can they say they are "going dark". How did they ever solve crimes before these things?

by fitblipper

8/15/2026 at 1:34:02 AM

Yes, are there any data points to suggest that this arms race is balanced any differently than it ever has been throughout history?

The cops will find a way, the criminals will find a way. It's ultimately people v. people with access to the same level of technology.

by jrowen

8/15/2026 at 5:16:06 PM

and everyone else will fall further and further behind

by graemep

8/15/2026 at 11:43:03 AM

Wire taps That's the point.

by sam345

8/14/2026 at 10:33:25 PM

I don't think the thesis that a government will be able to do something will ultimately hold. I don't see how they can avoid "going dark" in a democracy.

we live in a world where the government can't even do much about illegal drug markets anyone can access by downloading a piece of software.

if they pass laws that mandate backdoor access and block software which doesn't conform more and more people will move to the dark networks.

and if they effectively block the dark networks (in the limit they will have to block all encrypted communications) then we will be living in a tyranny.

freedom is messy. accept that digital crime can only be solved when the criminal makes a tangible mistake. LLM's will be building profiles on criminals to help with identifying mistakes.

by teravor

8/15/2026 at 2:59:56 PM

> we live in a world where the government can't even do much about illegal drug markets anyone can access by downloading a piece of software.

I think it's a mistake to think they can't - rather, they won't.

by squigz

8/14/2026 at 10:36:15 PM

The problem that Matthew Green is calling out subtextually is that democracy is likely to disappoint nerds on this issue: a random voter in the country 10 years from now may very well not share your priors about this issue.

by tptacek

8/14/2026 at 10:41:38 PM

consider the implications of a government where setting up an encrypted network is a serious offense, or where detecting encrypted communications is routine. the average voter doesn't matter. if they are willing to go that far it's a tyranny and the average voter doesn't matter anyway because they spy on everyone and have LLM's profile everyone (in that context even if voting still happens it doesn't matter, they will nudge the voters however they wish due to the information asymmetry).

by teravor

8/15/2026 at 1:29:18 PM

It doesn't need to be a serious offense. The current playbook works fine. Anything the Constitution prevents you from doing, have a private company do it for you. In this case you lean on, pay, or give preference to private companies to install back doors. Have the SC rule that you can't sell devices with certain encryption guarantees anywhere on the planet because planetwide commerce affects interstate commerce. Things like that.

by DangitBobby

8/15/2026 at 5:12:05 AM

> democracy

Still?

by DANmode

8/15/2026 at 7:05:29 PM

The US isn’t a democracy.

Sorry.

by DANmode

8/15/2026 at 8:28:07 PM

What is the USA then?

Especially curious what is the term for the current type of Government in the USA?

It's entirely different than any prior one historically speaking, isn't it?

by ALLTaken

8/16/2026 at 3:36:04 AM

A representative republic, historically.

by DANmode

8/15/2026 at 3:10:23 PM

Yes,if you realize it was always a scam to consolidate power in the hands of an elite few

by timedude

8/14/2026 at 11:50:43 PM

It breaks my heart that the governments with unlimited budgets who have hired the best and brightest will have to put in serious effort to get the bad guys, and potentially find it not worth it to casually spy on the whole world.

I am just beside myself at such an idea that people looking to feed the prison machine cannot as easily find excuses to turn normal citizens into prison feed.

Just super sad guys.

by RajT88

8/15/2026 at 12:12:00 AM

> excuses to turn normal citizens into prison feed

What felonies are those normal citizens being convicted of that's landed them in prison?

I get the basic 'not wanting everyone's comms to be monitored' part. I think there's an important conversation to be had because indeed, that can't be the answer.

But it sounds like you're saying most people who are convicted of felonies based on a jury unanimously being convinced by the electronic evidence against them... those people are unjustly in prison?

by xp84

8/15/2026 at 2:50:19 PM

Unironically yes, we convict people of felonies for the dumbest fucking reasons and working a jury is literally a science.

by fedpost

8/15/2026 at 12:45:01 AM

The issues with the justice system are well documented. Please do not try to straw man what I am getting at.

Certain people are arrested and detained far often than others, because of who they are and not what they did.

Many positions in the justice system prioritize conviction rate above all else.

There are many problematic relationships between legislators, law enforcement and the for-profit prison systems.

Our position in this list should make anyone afraid:

https://en.wikipedia.org/wiki/List_of_countries_by_incarcera...

If LE decides you should be "taken off the streets", regardless of if you did the crime you are accused of, you are likely going to prison for something unless you are wealthy. If you are wealthy, they may not bother. All very interesting.

by RajT88

8/15/2026 at 11:46:53 AM

You might want to try reading something other than leftist attacks on law enforcement. Yes there abuses here and there. But for the most part law enforcement works s in the constitutional rights of defendants are respected. And if they are not they are subject to appeal. The system is flawed but it works.

by sam345

8/15/2026 at 2:33:06 PM

It may surprise you to learn that I lurk the comments section at Breitbart. The subtext of the articles is made clear there.

There is plenty of distrust in LE and the legal system on the right. There is also plenty of people who believe it all is OK because "those people" are ending up in prison. You will never reach the people who do not care until it happens to someone they know, or someone like them.

by RajT88

8/15/2026 at 2:54:58 PM

Maybe try reading more leftist attacks on law enforcement?

Like, yes, the system works at the level you're assessing it. The problem is that it's based on a mountain of flawed premises and so we've ultimately created a literal torment nexus with a smiley face taped on top of it and everyone gets to wash their hands of it and go home: justice served.

by fedpost

8/15/2026 at 9:36:29 PM

So if someone critiques LE they’re leftist? That’s pretty lazy and definitely indicative of someone in a silo.

by Ydarbleoj

8/15/2026 at 3:19:23 PM

[dead]

by sadlyuramoron

8/15/2026 at 12:37:18 AM

The one who threw a ham sandwich at a Nazi at a protest?

by inigyou

8/15/2026 at 10:10:10 AM

You mean the guy who assaulted a federal officer and got off scot-free? Woe is him.

by GaryBluto

8/15/2026 at 11:52:29 AM

That's selective enforcement though. It's only "assault" because it was done against a cop. It's "just being a dick" when done against anyone else.

The danger of constant surveillance is that a lot more of these "being a dick" incidents will be prosecuted when politically convenient (because equal, fair prosecution of all incidents would not happen as that would quickly cause the law to be changed, preventing its future use selective enforcement).

by Nextgrid

8/15/2026 at 12:11:24 PM

I think that throwing a submarine sandwich at anybody would be considered assault or battery (unwanted, offensive physical contact), although I do think selective enforcement could be a real problem in the future.

by GaryBluto

8/15/2026 at 7:27:26 PM

You think if someone threw a sandwich at you and then just walked off, you'd be able to get in contact will law enforcement and get them to arrest the guy?

by xboxnolifes

8/16/2026 at 6:38:29 AM

You've nailed the issue in the justice system. When the recipient of harassment has power, or the recipient is favored by those in power for whatever reason, the response is disproportionate.

It shouldn't be so, but it is. It's human nature; the powerful use that power to defend their interests, unless prevented from doing so. The people without power or favor get watered down justice, if at all. The system isn't architected around this, but it's not architected to prevent it either.

by RajT88

8/15/2026 at 3:20:44 PM

[dead]

by sadlyuramoron

8/15/2026 at 9:38:15 PM

Assault is doing some heavy lifting here for the sensitive crowd.

by Ydarbleoj

8/16/2026 at 7:25:31 PM

https://en.wikipedia.org/wiki/Eggshell_skull

Everyone is legally entitled to this protection.

by zahlman

8/16/2026 at 7:24:47 PM

How come when you use extreme, beyond-the-pale rhetoric, that stays up; but when I politely point out that your rhetoric is extreme and beyond the pale, that gets flagged?

by zahlman

8/15/2026 at 4:30:14 PM

Just to be clear, by "Nazi" you mean a CBP officer?

And you consider this to be definitionally true; or do you have specific evidence of Greg Lairmore doing something that merits comparison to that regime?

Or do you actually believe that "people who entered a country without authorization and remained there long term with the intent of defying all local immigration law, should be extradited, by force if necessary" is comparable to killing a significant fraction of an entire ethnic demographic, worldwide, while simultaneously waging expansionist land wars?

by zahlman

8/15/2026 at 6:32:24 AM

>It breaks my heart that the governments with unlimited budgets who have hired the best and brightest

Why would the "best and brightest" work for governments that pay a fraction of market price?

by lotsofpulp

8/15/2026 at 9:04:22 AM

They work for private companies with massive government contracts

by broodbucket

8/14/2026 at 9:57:58 PM

I'm supposed to be concerned that the US government and Israel won't be able to hack everyone's phones?

by Gigachad

8/14/2026 at 10:04:53 PM

The reason why this might worry people who don't like the US/UK/Israeli governments is hidden in a secret place...a paragraph that is neither the first paragraph nor the last.

by hyperpape

8/14/2026 at 10:07:51 PM

Which is to say that they will become more authoritarian and aggressive? That's not a good reason to be unhappy that they can no longer hack shit. They shouldn't do that either.

by colordrops

8/14/2026 at 10:12:37 PM

The trouble is, sometimes governments do things that they shouldn't do.

by ameliaquining

8/14/2026 at 10:17:17 PM

Read the article. That's what the article says.

> Thus: over the next two years, major pieces of software are likely to run out of remotely-exploitable bugs.

> While I think this is great, for law enforcement and offensive intelligence agencies, it’s going to be a nightmare.

> So what do we do about it? I honestly have no idea. [...] it’s just occurring to me that we’re on a long greasy slide to a place that will look different than where we are today. [We’re] just going to have to hope that this time we make the right choices.

by lelandbatey

8/14/2026 at 10:12:20 PM

There are lots of things governments should and shouldn’t do, but unfortunately we don’t live in a vacuum, and need to consider the consequences of actions, rather than simply hope everyone is somehow forced to react the way we expect and desire.

In a nutshell, what I’m saying is “They shouldn’t do either” is at best a platitude and at worst a distraction preventing critical thought.

by kulahan

8/15/2026 at 9:52:19 AM

By this logic, we should never try to escape our abusers or resist our oppressors: we should just capitulate now, give them everything they want, and that way they won't escalate to (more) violence.

In a nutshell, this is bullshit. Bootlicker bullshit.

In a democracy (which our Western nations are certainly supposed to be, though that's become less true over time), if the people in government are doing things that are counter to the interests of the people, the appropriate response is to replace those people. Protest, contact your representatives and senators, contribute to campaigns that oppose what they're doing, etc.

And, of course, in an authoritarian state, if they decide they're going to add in backdoors to our phones, or ban encryption, or take whatever other draconian measures, then it doesn't matter a huge amount how we, the people, express our opposition to this; it's extremely unlikely that we have just enough collective strength and will to prevent them doing A, but not to prevent them from doing B instead. Either we can stop both, or neither.

by danaris

8/14/2026 at 10:15:17 PM

So our strategy should be to shut down AI so it leaves vulnerabilities everywhere? Not sure what you are saying. Fixing security bugs across the world's software isn't some single policy action that we can vote on.

Governments should behave. I know they don't, but they should, and the population should do everything in their power to force them to. What other choice do we have?

Please demonstrate your powerful faculty of critical thought and explain what we should do instead.

by colordrops

8/15/2026 at 12:11:41 PM

Not who you replied to. "They should" isn't a solution. "Here is proposed legislation," "I started a petition," "i spoke with my congressman," "vote for Pedro." These are concrete. "They should" isn't anything.

Like SMART goals, I believe the other commenter was pointing out that platitudes lack specific, measurable, achievable, realistic, and timely aspects required for organizing and achieving progress.

by sethammons

8/14/2026 at 10:11:22 PM

Nope. The article’s assertion is that governments will start to put enormous pressure on tech companies in their borders to include backdoors in their systems for LEO use. This in turn may lead to “nationalized” software e.g. what Russia and China largely do now, but in many more countries. You may have no choice but to use phones, computers, and software that is backdoored by your government - everything else will be illegal.

by donkey_brains

8/14/2026 at 10:26:10 PM

I think "nope" is in reference to "hacking" system. The point of the article is that hacking by software vendors that sell to law enforcement was a pressure relief valve that deflated the movement that the FBI was pushing at the time to have Apple (and others) build backdoors into their systems. If the phones could be hacked, and backdoors were not necessary the FBI could back off and still get what they want. If the FBI can't get what they want, they can either pressure the companies like Apple, or they can pressure congress to make laws requiring this. The phone makers could stand on principle, go to court, but the courts in the US are not very tech savvy, and usually deferential to law enforcement. Other countries may be better than the US, but some are definitely going to be worse.

So is a backdoor worse than a security vulnerability? I don't know but that is what this article is about.

by abruzzi

8/14/2026 at 10:12:50 PM

What do you mean "Nope", you mean "Yep" right? What you are describing is precisely "more authoritarian and aggressive"

by colordrops

8/15/2026 at 1:21:22 AM

It sounds like we should be gearing up for that fight then, so we can win it.

by iamnothere

8/15/2026 at 1:04:02 PM

I'm pretty sure you dropped a comment a while back about mailing systems. Finally got around to making my ideal prototype.

https://gitlab.com/here_forawhile/tmail/-/raw/main/tmail3.pn...

by smalltorch

8/15/2026 at 2:31:19 PM

I did, that looks pretty good for a prototype! I would suggest adding the option to send as plaintext email (disabling all formatting options), as this is still useful in some cases. Bookmarked.

by iamnothere

8/15/2026 at 3:46:09 PM

There's a code block option. I thought that would be useful too. Is that what you mean?

https://i.postimg.cc/0yKXWSbg/IMG-20260815-113546.jpg

Yeah follow along I still have alot of testing and polishing to complete before I call it v1.

No license on yet either. Still pondering that as well.

by smalltorch

8/15/2026 at 4:17:03 PM

No I mean sending an email fully in plaintext, see https://useplaintext.email/ (suggestions/justifications for mail client authors are near the bottom)

Also, be sure you are sending a plaintext copy (formatting stripped) using multipart/alternative, as most terminal mail clients can’t do HTML mail or can’t do it well.

by iamnothere

8/15/2026 at 4:21:18 PM

Thanks for the reference

by smalltorch

8/14/2026 at 10:17:01 PM

Tl;dr the argument is if three letter agencies can’t buy or make exploits anymore because all vulnerabilities are patched, they will ramp up legal and legislative pressure to make vendors install backdoors. Which is bad and we should all worry about.

One of the author’s blind spots here is the concept of “digital sovereignty”. The US is continuing to ban more and more Chinese-made hardware out of fear that the Chinese govt has installed backdoors in them… which you could interpret as an admission that the US does exactly that with American made products. Globalized supply chains are, erm, complex, and few if any companies are really going to be able to achieve “digital sovereignty” with hardware. But with software it’s actually plausible, though obviously hard. Whether or not the feds have actually installed backdoors in Microsoft Outlook, foreign govts are rightly concerned that they have, and are increasingly pushing to avoid US made software for simple national security reasons.

by turtletontine

8/15/2026 at 5:51:05 PM

The author of the article, Matthew Daniel Green, knows the capabilities of US to put backdoors into software and standards very well. Green's blog entries on NSA's backdoor in Dual_EC_DRBG, and RSA Security's usage of the backdoored cryptographically secure pseudorandom number generator (CSPRNG), have been widely cited in the mainstream news media.

https://en.wikipedia.org/wiki/Matthew_D._Green

by leonidasrup

8/14/2026 at 10:06:26 PM

Right? I saw "I’m concerned that U.S. intelligence and law enforcement agencies are about to go dark, meaning lose a huge portion of their capability." and my first reaction was GOOD.

by colordrops

8/14/2026 at 10:18:50 PM

What was your reaction after reading the full article?

by corndoge

8/15/2026 at 12:11:42 AM

I read the full article and have the same reaction. He's worried that civil rights will be in a better position and that we'll have to continue to defend them from that better position.

by ericjmorey

8/14/2026 at 10:19:36 PM

His argument is that the government is going to start forcing tech companies to install backdoors in their tech, now that (hypothetically) they can't use hacking anymore.

by wavemode

8/15/2026 at 12:12:24 AM

How is that not a better position than the current situation?

by ericjmorey

8/15/2026 at 1:34:45 PM

You know the old joke?

> I don't have to outrun the bear, I just have to outrun you.

It's like when the bear can't catch the slow guy anymore so he starts setting up traps and finding ways to cut off legs. Now the faster guy actually has to deal with the bear.

by DangitBobby

8/14/2026 at 11:40:25 PM

That was my first thought as well... But remember, they've got unlimited Mythos while we barely have Fable.

by matheusmoreira

8/15/2026 at 8:31:46 PM

Totally unfair, I would even say unethical and hostile towards US and EU people to restrict our access, but give the US Government full access to all, including all our data. Thanks ChatGPT/Claude!

I wonder what will happen with YC and this news-forum as it's owned by Altman too.

by ALLTaken

8/14/2026 at 10:18:23 PM

Which part of the article made you feel this way?

by corndoge

8/14/2026 at 10:15:43 PM

> In fact, the worst part about this dynamic is that these potential new backdoors will begin primarily useful for allowing the US to weaken its own systems, which will in turn allow foreign adversaries to find new ways to attack our communications. This deliberate self-sabotage will happen just at a moment when we’re finally learning how to defend our own infrastructure.

I don't understand how you can both argue for that law enforcement (and intelligence) agencies will force others to implement intentional backdoors AND also everyone will be using AI to find and secure ALL potential holes in the software so there won't be any vulnerabilities anymore.

Wouldn't one AI or another detect this deliberate backdoor and report it, as it'll look just like any other security vulnerability, the only difference being the intention?

I have respect for the author so I feel like I probably misunderstand something from the overall text rather than I somehow have a better perspective on this topic that the author knows very much more about than me. I felt like I nodded along all up until "So how is this a problem?" and now I'm not sure I understood correctly.

by embedding-shape

8/14/2026 at 10:21:04 PM

> Wouldn't one AI or another detect this deliberate backdoor and report it, as it'll look just like any other security vulnerability, the only difference being the intention?

That's precisely the author's point: deliberate backdoors will be more adversary-exploitable than ever before, but the demand for such from law enforcement agencies is likely to ratchet upwards.

by Majromax

8/14/2026 at 10:23:13 PM

> deliberate backdoors will be more

But that's one step after, I'm trying to understand how those backdoors even end up in software if everything gets automatically reviewed by the people working on these codebases? Wouldn't things like these be flagged by systems other than the developers tasked by the agency to implement it? How can law enforcement actually get these things implemented without big parts of the engineering team not seeing warnings about it happening?

by embedding-shape

8/14/2026 at 10:48:19 PM

I'm not sure you understand what is being described here?

If you're a US company building an app/device/etc. such that an intelligence agency like the CIA or FBI would want access to the data in that product which is normally secured, then they're not going to try to sneak it in there without your development team knowing. They're going to have a meeting with the owners of the company and say, "hey, we'd really like you to implement this backdoor for us, and in return we won't cause you in problems."

Note that this does certainly already happen a lot, but it's also not something that can happen across the board (like the author points out). Apple, being one of the largest companies in the world and who has one of their biggest selling points being their security, has explicitly refused to do this to the point that the intelligence agencies couldn't break into an iPhone until another company found a way to do so.

>I'm trying to understand how those backdoors even end up in software if everything gets automatically reviewed by the people working on these codebases?

The people working on these codebases are "in on it." Of course, we're talking backdoors which are very subtle, target very minimal infrastructure, and are known about by very few people. But, like I said, companies are currently shipping products with backdoors in them knowing they exist already. AI doesn't change that dynamic.

>Wouldn't things like these be flagged by systems other than the developers tasked by the agency to implement it?

The only people who would have access to the systems that can even be flagged by this stuff would be people who would know about it. Keep in mind that the scale we're talking here is massive. Think about how software development works at companies like Apple, Microsoft, Google, etc. There are devs working in offices all around the world where they only ever have access to a fraction of the code that company owns. These companies are very capable of keeping their stuff locked down. It's a necessary component of their work.

>How can law enforcement actually get these things implemented without big parts of the engineering team not seeing warnings about it happening?

Hopefully my explanation at this point is clear, but just to be concrete: backdoors are, by design, very hard to detect. That doesn't mean they're just sneakily written code that humans don't notice as they read over it, but, instead, they're very subtle implementations in very specific parts of huge systems that are already locked down to the point that the number of people who even have access to those portions of the systems are very limited. These agencies don't slip in backdoors without anybody noticing; they convince the minimal number of people needed to know about it to implement it. Again, we're talking about a meeting between the directory of a three letter agency and a CEO, where the CEO then directs the CTO to implement the backdoor who then instructs the handful of very high-ranking engineers to do so.

AI systems in these companies may very well flag these backdoors to the people who already know they exist, then these people can tell the AI "hey, those are their on purpose, so just move on," and the other 99.99% of the company will never know they exist.

I suppose it's important to emphasize, again, that these systems are incredibly massive and complex and most people at these orgs don't have any access to most of these systems, so it's not like you can expect an intern running BugBot across a repo and expecting it to find a backdoor.

by nater5000

8/15/2026 at 1:08:41 AM

I think people take the FBI or CIA too literally. I imagine they don't need to talk to owners and it's probably not even ideal. It might just be easier to get plants in the organization.

I would imagine most big companies, like Microsoft, have dozens of CIA and FBI plants in their organizations. Agents who are legitimate software engineers, tasked with acquiring intelligence and undermining security.

by preg_match

8/15/2026 at 12:21:02 AM

> If you're a US company building an app/device/etc. such that an intelligence agency like the CIA or FBI would want access to the data in that product which is normally secured, then they're not going to try to sneak it in there without your development team knowing. They're going to have a meeting with the owners of the company and say, "hey, we'd really like you to implement this backdoor for us, and in return we won't cause you in problems."

And then you say, loudly and publicly, "all the source code of our software is public, and our binaries use binary transparency so it's not possible for us to build a binary that doesn't match the source, and people will rapidly find this in our source code at which point we go out of business and you stop having a product to backdoor in the first place".

(And you move out of the US.)

And since this is a foreseeable future, you should start acting now to prepare for that future.

by JoshTriplett

8/15/2026 at 6:03:48 AM

With laws like Chatcontrol and all, other jurisdictions are not necessarily any better.

In fact, we're increasingly seeing a desire to build the "backdoor" directly into the software, e.g. mandatory age verification, client-side scanning, etc.

by supriyo-biswas

8/15/2026 at 10:01:12 AM

> And then you say, loudly and publicly, "all the source code of our software is public, and our binaries use binary transparency so it's not possible for us to build a binary that doesn't match the source, and people will rapidly find this in our source code at which point we go out of business and you stop having a product to backdoor in the first place".

> (And you move out of the US.)

And then everybody claps.

Name me a software or hardware company—one big enough that the US government would actually care to force them to add a backdoor—that would be willing to give up the US market? The only one that's shown the least bit of backbone is Apple, and while I like them and appreciate what they've done in that vein so far, they're never going to move to open source software running their stuff, and they're pretty well embedded in the US, and very, very unlikely to try to move regardless of the headwinds there.

I'm fully with you that this would be a wise and moral thing to do, but frankly, our tech companies are neither wise nor moral. They are self-serving, greedy, and many of them have wanted to become the neofeudal overlords of a new order since before Trump started smashing the old one.

by danaris

8/15/2026 at 12:04:03 PM

I'm not suggesting giving up the US market. I'm suggesting moving out of the US and continuing to serve the US market from elsewhere, because the US does not have a nation-wide firewall. And working with organizations mounting legal challenges to "please destroy your company in order to put in a backdoor for us".

Certificate Transparency has essentially eliminated the problem of backdoored CAs, because attempting to do so would destroy an entire CA. Binary Transparency can do the same for software.

by JoshTriplett

8/15/2026 at 3:14:37 PM

I'm not sure exactly what you think that will accomplish...?

Companies have to follow the laws of the countries they operate in, not just the countries their physical headquarters are in.

That's why, for instance, Apple has to follow the DMA in Europe.

Furthermore, especially for many of the tech companies, where they are located is an integral part of their culture. They are Silicon Valley. You're going to have a very, very hard time convincing any of them to up stakes and move.

And further-furthermore, move where? Europe has, unfortunately, made similar authoritarian noises (eg, Chat Control). China is already more of an authoritarian state than even Trump's USA. Ditto for Russia, and, AIUI, India, though both in somewhat different ways.

by danaris

8/16/2026 at 12:40:03 AM

The degree to which you have to follow the laws of a place you have no legal nexus in (e.g. no employees) is limited. Non-US companies can and do refuse overreaching requests from the US sometimes.

Apple is subject to the DMA in europe because 1) they have employees in Europe and 2) they want to import and sell physical phones into Europe. It's easy to block imports or fine employees. It is not especially easy to prevent people from spending money on a service provided entirely via the Internet from another country.

It is not at all impossible to impose sanctions on an entire company. But if the US tried to do so over a refusal to put in a backdoor, and the company very loudly made that clear, that would to some extent be exceptional free marketing.

by JoshTriplett

8/15/2026 at 1:42:55 PM

Why can't the backdoors themselves be more sophisticated? I understand that expecting such sophistication from legacy companies is a joke at this point.

by conmod278

8/15/2026 at 3:33:54 PM

There's no such thing. If it can be cracked open, then it's only a question of time until every criminal on earth has a matching crowbar.

by classified

8/14/2026 at 10:23:05 PM

I suspect they want a backdoor that basically acts like a front door (current password regimes). That is, a kind of high level password that decrypts traffic given a specific, changing, password that only the government has access to.

It's seems like an odd-duck for sure, and I doubt it's a realistic proposition. I do think "perfect encryption for dummies" is all well and good until organized crime organizations are able to challenge the government in certain regions of our country.

All of this sends us deep into the realm of political philosophy, the nature and purpose of governments, and the freedom vs security tradeoffs we live with.

I listened to the latest Plain English podcast this morning, which was explicitly about the potential for a ransomwarepocalypse in the coming years, as open models let any tom, dick, or harry become capable of a plug-and-play ransomware attack, instead of that being left to the realm of professionals. It's a bit nerveracking to think about every nigerian prince scam suddenly becoming a sophisticated attack on your local water sanitation system.

https://youtu.be/vWvazbGPCCI

by scoofy

8/14/2026 at 10:25:14 PM

Ah, like new regulation requiring a "Portal For Law Enforcement" for platforms over X MAU or something?

I think I can kind of see that from the text re-reading it, it's kind of hidden though and not so explicit if this is what he is trying to communicate. Thanks for giving me a new perspective to read it with!

by embedding-shape

8/14/2026 at 10:22:33 PM

The author agrees with you and addressed this point. The US forcing backdoors into its own systems ("own": Those for sale and distribution within the US) would create vulnerabilities making those systems weaker.

by Jtsummers

8/14/2026 at 10:24:35 PM

"backdoors" aren't holes, they are well-documented superuser APIs. The hack will be by compromising the API user's credentials (moles, stolen passwords, etc), not compromising the server's design intent.

by gowld

8/14/2026 at 10:10:55 PM

I dunno man, if there's a deluge of new AI generated code at all layers of the stack I think there will still be vulnerabilities.

Like if we were willing to stop adding new code and just have a small secure code base, AI could maybe help us find all the vulnerabilities in that code base.

But people have consistently been unwilling to do that. Like if we were willing to stop adding code we could have stopped decades ago and done SQLite level testing everywhere and probably have found almost all the bugs already.

by pianopatrick

8/14/2026 at 10:17:54 PM

When we've got people who don't know the difference between ssh and bash creating SaaS companies that generate revenue, yeah there's gonna be a lot of insecure code going out, but that same person can also tell the AI "red team my app to find vulnerabilities and then fix them", and the AI can competently actually do that, I don't know that there will be. I'm not saying that's never going to happen, but the bar is getting raised on both sides.

by fragmede

8/14/2026 at 10:26:37 PM

Plus, the interest and expertise and passion used to favor the red team, attackers. If you wanted to defend against them you had to get on their level, or hire someone on their level. Thats either expensive or requires a time investment that doesn’t make sense for someone who is trying to do much more than just defend against attackers.

Now it’s just as you said- asking AI to red team your app will get you pretty far.

by draw_down

8/14/2026 at 9:48:21 PM

> Defenders are now in the process of patching every bug they can find, often with AI helping them. Entire development toolchains are being rebuilt to incorporate powerful vulnerability scanning before software reaches the testing phase. This does not mean that every bug will be found: even calculating the number of bugs in a piece of code is probably uncomputable. In the real world, it does feel likely that we’re going to hit some sort of a ceiling on the number of useful bugs, and probably we’ll hit it soon.

> Thus: over the next two years, major pieces of software are likely to run out of remotely-exploitable bugs.

His conclusion sounds extremely optimistic to me.

by bell-cot

8/14/2026 at 10:01:25 PM

The number of remotely-exploitable defects is going to drop by 1 or 2 orders of magnitude. We now have amazing machines that will find pretty much all the a priori knowable ones. They outperform even the most gifted h@x0rs. So that just leaves a small pool of leetrs to scour a very barren landscape. And that pool is also shrinking as we rely more and more on the ai tools.

Perhaps we are going to go up a level with hacking done by probing the systems and the system of systems.

by bahmboo

8/14/2026 at 10:15:01 PM

It all boils down to money/resources, like always.

Pre-AI, the advantage went to the entities with the largest budget to hire the best and brightest security engineers.

Post-AI, it'll go to the entities with the largest inference budget.

Right now we're in a transitionary period where it's kind of a tossup which approach is more practical, but at the end of the day - it's still all about how much money you can throw at the problem. I'm just hoping the threshold climbs high enough it's no longer practical for governments to be able to compromise individual actors' devices because doing so would waste a 0-day that's far, far more valuable than prosecuting one arbitrary person is worth.

by Ancapistani

8/17/2026 at 7:10:00 PM

That assumes that software is endlessly exploitable. We are also able to use AI tools to more easily move software into the realm of formal verification where there is no implementation defects only logical ones. Ones that can be reasoned about using things like Lean and Coq. Microsoft does this with their cryptographic stack. It's a very interesting branch of software that I think will be getting much more popular.

by bahmboo

8/14/2026 at 10:31:55 PM

It's not as simple as money, people are motivated by other things as well. There's no amount of money you could pay me to intentionally hurt children, but I'd do a lot of things to protect them. And a lot of things people say they're doing in the name of protecting them but has ulterior motives, so it's complicated.

by fragmede

8/14/2026 at 11:13:13 PM

I agree, but broadly speaking it doesn’t change much that what I described breaks down at the level of an individual. There are very few instances where the global talent pool is small enough that individual beliefs become a constraint.

There’s (almost) always someone else out there that is willing to do it, and there’s (almost) always a dollar amount that you can’t turn down.

by Ancapistani

8/14/2026 at 9:39:59 PM

Sounds like a pretty strong argument to self host, and otherwise be in charge of the software you use.

by Carrok

8/14/2026 at 9:49:43 PM

Including your AI agents. And models become problematic. There very likely is and/or will be lots of pressure for US AI labs to make models help law enforcement. It could be by implementing backdoors in generated code, or not report some exploitable bugs, or something else. Similar for agents, they basically become the threat in your infra…

(It’s of course not only the US, just that the largest AI providers are US based and we know from history how US agencies operate)

by dgellow

8/14/2026 at 10:11:05 PM

Yep.

I'm using open weights models on a privacy-focused provider right now, and that's adequate for my current usage, but I'm rapidly getting to the point where my agent's access level to my data (and to a lesser extent, my accounts) is becoming something I'm not comfortable sending outside my network at all.

My hope is that models that are roughly on par with Deepseek V4 Flash can be run on hardware that I can own for <~$5k in the near future. We're close, but not there yet as far as I know.

The only long-term solution to this is self-hosting.

by Ancapistani

8/14/2026 at 11:38:25 PM

There is literally no protection or difference of an opensource model doing this.

An actual objection I had while talking to an aerospace company was they don't want opensource models because the threat of it having a poisoned training example on specific systems.

It's easily the most hidden malware possible, completely undetectable until an exact set of tokens unlocks it. Is it line 100,543 of your security product? You will literally not know until it plants it in there.

by johnsmith1840

8/15/2026 at 10:04:08 AM

To the best of my knowledge (which, admittedly, is far from comprehensive), that kind of attack on a model shouldn't actually be possible in a deterministic fashion.

If you can't stop them from sometimes telling customers things like "yes, I will give you a penthouse suite at our hotel for only $3/night", why would you be able to guarantee that, with some specific set of tokens, they would produce a perfect and undetectable backdoor customized to the code at hand?

by danaris

8/15/2026 at 10:19:43 AM

I don’t think it has to be perfect or deterministic that way. It’s enough to have a bias towards implementing a backdoor in some circumstances. Something like, if the machine seems to be used in a Chinese environment, the model is biased towards missing some security issues, or towards implementing the type of bugs that can be used for an RCE, or similar.

Anthropic has done such checks at the agent level: https://cybersecuritynews.com/anthropic-claude-hidden-code/

Their excuse was defending against distillation attacks but you can see how that can be abused

by dgellow

8/15/2026 at 10:03:09 AM

You can review generated code manually or with models from a second vendor (ideally from a different country). Attackers would have to poison both and do it in a way that also makes them ignore the planted malware when reading code.

Open models also let you read reasoning traces. That means anomalies would show up when the backdoor activates, like a run of unrelated words or a jump in top token probability. It's only undetectable until the first time it happens.

by tancop

8/14/2026 at 10:05:45 PM

Self host + open weight models, exactly the things that openai/anthropic don't want you to have

by gloryjulio

8/14/2026 at 10:15:23 PM

How do you think self-hosting will help in this situation?

by otterley

8/14/2026 at 10:20:50 PM

I think what’s unintentionally eye-opening about this chart is the recency of “law enforcement can read your text communications.”

Law enforcement doesn’t need this surveillance ability at all. All time periods prior to 25 years ago didn’t have it.

Additionally, there is no correlation between “law enforcement reads text messages” and crime rates going down.

by Grombobulous

8/14/2026 at 10:26:47 PM

Not trying to defend our national dystopian nightmare of a surveillance state — but I'm pretty sure this is wrong?

Crime's been decreasing for years, and (from what I understand) this year is tracking to be one of the safest years on record?

Definitionally, there absolutely has to be a correlation (not causation) between those two factors you listed.

https://ourworldindata.org/us-crime-rates

by jackp96

8/14/2026 at 11:01:55 PM

Didn't freakenomocs claim it (crime rate) was (primarilary) about abortion in the 1970s and less unwanted (and unsupervised/undisciplined) children growing up?

by edoceo

8/15/2026 at 1:10:38 AM

There’s also the leaded gasoline theory.

by Grombobulous

8/15/2026 at 1:10:18 AM

These charts make the exact point I was making.

Most of the crime decrease from its peak happened before the year 2000.

That means back in the days of law enforcement needing to do low-tech wiretapping techniques, crime was still rapidly decreasing.

There’s just not even a correlation. And, as a reminder, correlation is not causation even if it was there.

by Grombobulous

8/14/2026 at 11:02:27 PM

Governments and their agencies shouldn't have any access to the communications of private citizens. If something like terrorism is the issue, the correct response is to use the wealth and resources of the government to address the root causes of those attacks, not to undermine my right to privacy.

by ayaros

8/14/2026 at 11:49:20 PM

This is untrue when private citizens are in conflict (legal or physical or whatever) and the dispute needs to be mediated or resolved. The 'root cause' may well be she said/he said and the legal system may well have need to resolve this by looking at private communications.

Strong emphasis on the legal system part, but you've completely dismissed that private communications frequently are required to address causes of issues and the word subpoena makes it rather clear that refusing to comply comes with penalty.

by bigDinosaur

8/15/2026 at 3:34:36 PM

In that case, government still doesn't have access; they have to be granted it, even if there is a penalty for non-compliance.

by Chris2048

8/15/2026 at 4:25:25 PM

I think this comes in with the wrong assumptions from the start. The thing that US vs Apple taught us is to not demand access publicly, this puts companies in an awkward spot. If approached more tacitly, gag order etc the company has nothing to gain but everything to lose.. and more likely to comply. I hugely doubt that intentional backdoors don’t exist for the most powerful countries / people

by tipsytoad

8/14/2026 at 10:16:02 PM

This "going dark" scenario would require new legislation. With secure enclaves, modern smartphones can't be cracked open in the manner that the FBI wanted in the 2016 case. So there's no such thing as "court order tech company to crack phone" anymore. It would have to be "outlaw tech companies from producing phones that they can't crack open", which is very different and does not fall under any existing US statute.

by wavemode

8/15/2026 at 12:40:13 AM

Congress would pass that law in a heartbeat.

by inigyou

8/14/2026 at 10:22:35 PM

Man I thought from the title this was going to be about next-gen AI being able to zero day everything so effectively that software security is meaningless and we'd need to basically shut it all down, go dark.

by bottlepalm

8/14/2026 at 10:25:40 PM

[flagged]

by wseqyrku

8/14/2026 at 10:28:00 PM

Won’t someone please think of those poor helpless law enforcement agencies!

AI code is flawless and impenetrable!

by willturman

8/14/2026 at 10:50:02 PM

Well, it's certainly impenetrable.

by wizzwizz4

8/14/2026 at 10:24:08 PM

We will know we've made systems secure when laws focus on compelling people to provide access.

These laws exist - they aren't the focus yet. Right now there's still no need; just hack the device or compel the cloud service to give the data, why waste energy getting consent from its owner!

More bugfinding AI, more end to end encryption, more CVEs and more fixes, cannot happen soon enough.

by cadamsdotcom

8/14/2026 at 11:23:30 PM

I would like to point out that the last year when not a single law enforcement agency anywhere in the world could have possibly tapped anyone's phone was 1876.

150 years ago was the invention of the telephone, and I think that articles like this seem to assume that prior to this, police just never caught any criminals.

by bloaf

8/14/2026 at 11:34:51 PM

> 1876

A year when police were relatively rare, and quite new in the western legal experience, having only emerged from slave patrols in the United States and from the founding of the 1829 Scotland Yard in the United Kingdom. This is a year with living memory of a time when the state did not employ people to do what was ostensibly the civic responsibility of every person to quell crime and protect others.

by jMyles

8/15/2026 at 11:58:37 AM

So you are advocating no police? You want people to police themselves? .Good luck with that.

by sam345

8/14/2026 at 10:03:09 PM

> This is not a call to action for experts to rally behind a sophisticated plan. Like so many things about the AI revolution, it’s just occurring to me that we’re on a long greasy slide to a place that will look different than where we are today.

heh. long greasy slide. It really does feel like that.

by natecodes

8/14/2026 at 10:53:10 PM

Considering from a point of view stipulating that perfectly secure software is possible. I don't think it follows that the limititation that it would place on intelligence is necessarily a net loss.

Apart from the obvious harms of invasion of privacy, and fishing expeditions being biased to the places you decided to fish. There is the simple fact that data can be misleading, especially without context. An interceped communication is a piece of data that is intrinsically tied to the trust of the inteceptor. A few people with an agenda can collaborate to create a seeming truth by 'discovering' the same thing from different sources.

Requiring warrants compelling information holders to provide data, not only serves the task of protection from abuse but also create a record of provenance that can be verified.

It also provides a degree of symmetry in capabilities which discourages actions that one party may do over another if they are motivated to act because they have a temporary advantage over another.

by Lerc

8/14/2026 at 9:50:46 PM

> In this case, we’re just going to have to hope that this time we make the right choices, for no other reason than that they’re right.

I'm more curious what could be a right choice, and more importantly who is the "we" in this, as many decisions are largely made by companies and governments.

by tolugenius

8/14/2026 at 10:04:06 PM

As far as I'm concerned, the right choice is that the US government learns to live with remotely secure devices in the hands of everyone. No new laws are passed to force hardware/software makers to insert remote backdoors. Law enforcement and intelligence services have to investigate targets using metadata, publicly posted information, the numerous online service providers who are already subject to warrants, and physically proximate surveillance.

by philipkglass

8/15/2026 at 12:38:59 AM

Great. I also choose for the US government not to backdoor my device. But I think it will do that anyway, what should I do about it?

by inigyou

8/14/2026 at 10:13:25 PM

No system view. The law agencies can develop exploits to intercept our phones, that is a new, and totally unseen before threat.

Unless you remember 2013, Snowden, that nothing was done (at most was some concern about doing it to US citizens, the rest of the world doesn't deserve privacy), all US (and/or five-eyes) based web companies must disclose users information and be forced to not disclose that, and things kept going surely at a faster and more intrusive rate in everything else, and of course phones.

You are complaining being sprinkled by water while at the bottom of the ocean. At least the big companies can find their own vulnerabilities with the AI tools you mention, the rest of the doors are still wide open.

by gmuslera

8/15/2026 at 6:17:01 PM

I don't get it. They can get access to all of our shit through vulnerabilities, but nobody knows about it. In the author's hypothetical world, they get access to all our shit through backdoors, which they have to introduce through a public legislative process, so everyone knows about it.

If they can get access to all our shit, at least make them say it out loud and put in the effort to get legislation passed. There's no upside to the current situation.

And it's not like they're not trying to introduce backdoors already... Seen the whole age verification thing?

by franga2000

8/14/2026 at 10:06:27 PM

I think that one of the reasons they (frontier companies and the gov) will be putting so much effort into curtailing bugs and vulnerabilities is to limit the blast radius of future AI models. Imagine with the new Sol Ultrafast, they could have pwned Hugging Face in 6 hours and not 4 days (IIRC).

It also seems likely to me that the US Gov. probably already has routine mechanisms for compelling targeted software updates for persons of interest, so I'm not sure that a more formalized backdoor than automatic updates is going to be surfaced in the mainstream, unless that is avenue is also cut down somehow.

by Scryptonite

8/14/2026 at 10:23:37 PM

Google has started publishing "binary transparency", this would help detect unusual software updates, while other methods (including AI) would help detect normal backdoors.

Basically in the AI age, the difference between a vulnerability and a backdoor diminishes..

by zb3

8/14/2026 at 10:36:13 PM

I may be naive, but how would binary transparency be effective if they ship an update to disable that on a target device? As long as there is a need for legitimate automatic software updates, the possibility of pwn updates will always exist. Plus a myriad of layers, keys and other stuff they could use NSOs to 'seize' and inhibit knowledge of their effort from leaking, or cleverly hide in plain sight. And someday, with the help and speed of AI.

by Scryptonite

8/15/2026 at 10:30:21 AM

I think the authors treatment of backdoors and exceptional access is a narrow focus.

We will certainly see “front door” access as various places have or are attempting to enact client side scanning, id verified online access, software root of trust remote attestation, and the general attack on e2e.

Taken together your identity tied to unmodifiable software, necessary to access the web or modern economy with client side scanning and no e2e … is a front door.

All this has nothing to do with ai, bugs, hackers or security vulnerabilities, let alone backdoors

by getcrunk

8/15/2026 at 1:20:35 AM

Without vulnerability derived backdoors I am convinced the government will strong arm the corporations to build a backdoor for the three letter agencies—at least in the US. But we also are at the dawn of quantum systems which could make interception and spying impossible or at least made obvious to the user when it happens.

Exhausting infrastructure vulnerabilities even without quantum could be a game changer for many technologies and enable things we can’t do right now, like vote on our phones.

by noisebuffer

8/15/2026 at 1:27:43 AM

But isn't that the point the writer is making? They'll be self-sabotaging themselves once they do that.

by parapsychic

8/15/2026 at 4:12:12 PM

I don’t exactly see how, if there’s no exploit.

Either way there’s other realms it’s relevant like armed drones policing a street. Without a way for the public to activate a shutdown sequence, it becomes very difficult to stop if it starts murdering innocent children on some glitch. Which you cannot have because then the whole purpose is ineffective. Likewise digital communication is purposeless and face competing mediums for sure

by noisebuffer

8/17/2026 at 5:35:58 AM

hmm fair. so a foolproof backdoor that cannot be exploited by the enemies. I don't know how much of that is possible, but then again, the author is talking about super-secure-no-exploit software. So by that definition, a super secure exploit-free backdoor is also possible.

by parapsychic

8/15/2026 at 6:39:26 PM

I strongly disagree with this view. The US government will most certainly convince OpenAI, Anthropic and Google to make sure that their models leave a backdoor in most systems that they code. I don't know how, but that's a problem that a team of people paid tens of millions a year each will try to solve.

There is NO WAY the US government will let most of the software world go dark.

by simonebrunozzi

8/15/2026 at 6:52:44 PM

I’m guessing you didn’t read to the end, because that’s exactly what the author argues.

by senordevnyc

8/15/2026 at 11:10:01 AM

For the HN 14 day record since I didn't see this yet: in genuinely critical situations, if the threat model includes a device/service being used against one's self, "the only winning move is not to play" (stop the use of the device/service!)

In the same manner, if the critical concern is a device/service being used against one's self remotely, stop the use of the device/service if it is capable of remote access or data collection for later retrieval.

The ultimate baseline reality is that deciding to care whether or not remote access/data retrieval is using a method supported by the device manufacturer/service provider and/or whether doing so is allowed by the current legal system is too late.

Premptive HN disclaimers: I acknowledge the growing unavoidability of devices and services supporting remote access and/or data collection as I type this here on my phone. Remote access and data collection are very convenient and somehow still expected by device owners and service users to be under their control alone. It can be difficult to determine if a device or service supports remote access/data collection. There are often immediate consequences and eventual legal consequences for stopping the use of devices or services that belong to others. Working to change the legal system to slow/reduce use of devices and services against one's self and encouraging others to do the same is admirable.

by password4321

8/14/2026 at 10:33:07 PM

I predicted a long time ago that if computers become unhackable LEA and intelligence agencies will push for laws that require backdoors to be built into hard- and software.

It will be interesting to see if my prophecy becomes reality.

BTW I also hate that Hacker News is being dominated by articles on A.I. lately. Maybe we should vote on HN reducing or even eliminating A.I. related news?

by hn_submit

8/14/2026 at 10:34:09 PM

Some people point out AI can cause bugs as well as fix them, and its a valid point. But the question is: what will the ratio be?

If automated pentesting in PR review CI pipeline will become table stakes - which is very plausible - maybe the OP has a point.

by ixxie

8/15/2026 at 10:02:10 AM

> So what do we do about it?

I just hope that politicians don't jump in and say "we know how to fix it", because unfortunately where they put their hands, they just make things worse (regardless of which country)

by pelasaco

8/15/2026 at 12:23:42 PM

Doesn't this just mean criminal suspects will be forced to unlock their devices using biometrics (in the US)? That should buy law enforcement some more time until biometrics go out of favor.

by password4321

8/14/2026 at 11:05:15 PM

I completely disaggree with this take. Modern AI is not yet capable of finding multi-component bugs as advanced as those produced by firms like NSO.

by maxo133

8/14/2026 at 11:27:38 PM

Yes it is, it hacked Artifactory to get to Hugging Face.

by pineapplepizza6

8/14/2026 at 11:49:19 PM

They are not.

Developing modern 0-day zero click RCE exploits chains like those developed for iOS is far more complex than hacking to generic company servers

It's completely different scale of difficulty factor. Not a single documentated case of of any AI tool developing such exploit exists

There is a reason why those mobile 0-day exploits are sold and bought on exploit gray market for as much as 10-20 million dollars each

by maxo133

8/15/2026 at 12:40:54 AM

Why?

by inigyou

8/15/2026 at 4:28:46 PM

I'm going to be a little epistemically silly here. Why doesn't Goedel's incompleteness theorem apply to the assertion that AI-enabled patching will prevent all exploits?

I'm quite in favor of impenetrability of software as the alternative is constant friction, to be honest.

by tomrod

8/14/2026 at 10:25:27 PM

> In April, Anthropic announced a new model called Mythos that was optimized for software vulnerability finding

No, it was just good at it because it wasn't RL'd against it. I know this is a small detail, but it tosses journalistic credibility in my eyes.

by dangoodmanUT

8/14/2026 at 10:31:43 PM

Even after the initial leaks, Anthropic themselves say they've improved on cybersecurity amount other things, giving the perspective (even if not 100% clear) that one of the focuses was vulnerabilities:

> In response to questions about the draft blog post, the company acknowledged training and testing a new model. “We’re developing a general purpose model with meaningful advances in reasoning, coding, and cybersecurity,” an Anthropic spokesperson said. - https://fortune.com/2026/03/26/anthropic-says-testing-mythos...

It is possible it is both, they used to RL against cybersecurity, but also didn't explicitly do any qualitative tests and added/changed more data because of those results. For Mythos, they stopped RL'ing against it, and also now intentionally try to make it better.

Unless of course they've actually noted exactly how things were trained here in some technical report and I've missed it, that's possible. Anthropic aren't famous for being very public about their internals though, but would be curious to read more details about it if it's out there from the horse's mouth.

by embedding-shape

8/14/2026 at 10:37:50 PM

Matthew Green isn't a journalist, he's a practitioner (and a cryptography professor at Hopkins).

by tptacek

8/14/2026 at 10:26:35 PM

RL'd?

by lazyasciiart

8/14/2026 at 10:28:00 PM

Reinforcement learning, I'd assume.

Presumably RLHF (Reinforcement Learning from Human Feedback).

by Ancapistani

8/15/2026 at 2:20:21 PM

Best-written article I've read all week.

by Eleg007

8/15/2026 at 12:42:41 AM

i wonder how many open source projects have alphabet boys building trust as contributors for eventual backdoor planting

by 0xDEFACED

8/15/2026 at 1:15:51 PM

I think US law enforcement will just continue to wiretap everyone at the "SSL added and removed here" SaaS known as cloudflare.

by happosai

8/15/2026 at 1:35:22 AM

But Matthew, think of the kids!!1

Honestly though, framing this as a "tech issue" doesn't help IMHO, it just muddies the water. Ever since RSA was invented privacy has been about educating people on how to use it effectively and _why they should care_. If voters now are choosing authoritarianism over democracy and individual freedom, I think we have to face the reality that after almost 50 years of fighting battle after battle on the technology front, we've largely lost the war on the home front in this regard.

by twothreeone

8/15/2026 at 2:10:28 AM

So I've read dozens of complaints that AI produces insecure code.

I, for one, usually tell my AI to start with secure code, make it small, and modular.

This is the first article I've seen that now says the opposite ! AI will make code too secure!

Since the small amount of AI coding I've done often results in buggy code (even a shell script written today) with the AI go-to solution of "write more buggy code to fix", this seems counterintuitive.

by newsomix9xl

8/15/2026 at 2:43:24 AM

Considering the amount of AI slop being generated today and LOCs that no one actually reviewed, I doubt we will run out of vulnerabilities to exploit...

by elisbce

8/14/2026 at 10:55:09 PM

article read to me like a typical rehash of a typical offense-defense cycle. AI would have written a better article.

I personally welcome such spiraling offense-defense cycles as it is one of the main drivers of the technological progress.

by trhway

8/15/2026 at 8:14:31 PM

As an anti imperialist, I can't wait for US secret services loosing their capabilities :) by the national security that the tech oligarchs (and this article, too) are constantly talking about, they just mean their own security anyway. It's not for you and me, duh.

by the_wolo

8/15/2026 at 5:39:54 AM

Nononono no more of this shit

I remember walking into some shitty congresscritter's office with a fucking years old one pager, with a few more citations written on the bottom in pen because I wasn't going to bother making it pretty this time around.

You should have seen his face when i asked him straight up: dude, you seem to have a problem processing information. Are you having some kind of medical issue? Because I'm not the last staffer: If you abuse my time, I am never coming back here again to add more citations to a fucking one pager from 1999 -- I'm making it my mission to remove you if you fuck this up on purpose ever again.

(Or something to that effect -- I've been told I can get a bit aggressive in my rhetoric.)

This was approximately 2016 and that individual is no longer in office.

I stand by my words.

by firefax

8/15/2026 at 7:46:27 AM

What one pager, what words? This story needs more context if it is going to make sense

by rowyourboat

8/15/2026 at 1:06:28 PM

No, I think the beauty of it is the ambiguity, but I think there's a culture here that is distinct and different from the creative nonfiction community, so I'll try to be more mindful of whether the site is blue or orange.

by firefax

8/15/2026 at 1:48:33 PM

tcp/ip itself is the ultimate backdoor, similar to the pstn backdoor in the post.

genai doesn't change that anytime soon?

by gz5

8/15/2026 at 12:42:13 PM

This guy is worried that we might stop having exploits, and that's somehow ...a bad thing?

I thought I've read the worst takes about most things, but this still deserves some kind of prize.

by coldtea

8/15/2026 at 12:48:20 PM

I think the problem is that, without organic exploits, we will have to create backdoors on USA systems, making our systems especially vulnerable in the global ecosystem.

by caiquelira

8/15/2026 at 1:04:44 PM

How about not creating/forcing ANY exploits?

by coldtea

8/17/2026 at 4:09:02 PM

Shrug~ I'm sure they'll find a way. They have power; they don't need more.

by MetroWind

8/15/2026 at 12:38:44 AM

[flagged]

by mitchell5584dm

8/15/2026 at 12:37:13 AM

[flagged]

by mitchell5584dm

8/15/2026 at 1:36:52 AM

[flagged]

by newHempter

8/15/2026 at 6:09:27 AM

[flagged]

by fenestella

8/14/2026 at 10:51:03 PM

[dead]

by TechDebtDevin

8/14/2026 at 10:23:30 PM

> I’m concerned that AI is going to make software much too secure.

Lmao this is like “I’m concerned the raccoons that I see in the storm drains are going to make our sewer system much too efficient”

by jrflowers

8/14/2026 at 10:17:53 PM

Childish, nation-states as powerful as the US have access to much more potent stuff. Maybe they'll be forced to rely more on their Intel ME/AMD PSP/modem (cf https://redmine.replicant.us/projects/replicant/wiki/ModemIs...) backdoor and ANT James Bond catalog.

by BoingBoomTschak

8/15/2026 at 4:16:27 PM

> The destruction of the low-hanging vulnerability fruit will make law enforcement (and intelligence) agencies’ need much more acute. The demand for constructed, intentional backdoors will re-start in earnest.

Maybe I am overlooking what the author intended but I feel this has already happened and may be the reason why there is so much pressure to create the surveillance state.

I feel more like the push for AI to provide better security (everything?) is an excuse to create a paradigm shift with the ultimate purpose of replacing free societies with fiefdoms of corporate culture returning us to the dark ages but with technology running the show.

It started way before AI. There are good uses of the technology, but obviously we have a culture of criminal accelerationists that are going to use this overpowered tech to shape society into a system of slavery.

by trinsic2