Experts have long warned “secure backdoor” systems are impossible; Salt Typhoon's reported hack of US ISPs' wiretap systems exemplifies the risks of backdoors
Security professionals and technologists have for years been sounding the alarm about the security risks of backdoors … Riana / @riana@mastodon.lawprofs.org : “Blaze told TechCrunch that the Chinese intrusions into U.S. wiretap systems are the latest example of malicious abuse of a backdoor ostensibly meant for lawful and legal purposes. The security community has long advocated against backdoors, arguing that it is both technologically impossible to have a “secure backdoor” that cannot also be exploited or abused by malicious actors.” … Zack Whittaker / @zackwhittaker@mastodon.social : There 👏 is 👏 no 👏 such 👏 thing 👏 as 👏 a 👏 secure 👏 backdoor. — https://techcrunch.com/... Bluesky: Scary Mary Branscombe / @marypcbuk.bsky.social : secure systems with a backdoor are like the rhythm method of contraception - much more about luck than judgement [embedded post] @riana.bsky.social : Beyond its “told you so” relevance to the crypto wars, one point this story makes is that when your phone service provider gets pwned, normally they have to disclose that promptly, but the USG can suppress the disclosure if there's a natsec angle. Consumer (and shareholder) protection loses out. …
Context & Ripple Effects
The discussion follows reports that Salt Typhoon breached networks at major U.S. internet providers and may have reached wiretap-related systems, turning a longstanding encryption-policy argument into a concrete telecom-security concern. The earlier reported ISP network breach supplies the operational backdrop for the warning.
It also revisits a persistent technical dilemma: efforts to design exceptional access without creating a broadly exploitable weakness have repeatedly drawn skepticism, including an earlier attempt to devise a safer device backdoor. The story matters because wiretap infrastructure concentrates both lawful-access capability and high-value attack surface in the same systems.
First-order effects
- U.S. telecom providers and government users of lawful-intercept systems face immediate pressure to determine whether access pathways or adjacent network systems were exposed in the reported intrusion.
- The episode strengthens security professionals' case that a backdoor intended for authorized use can become a route for unauthorized access, while national-security disclosure limits may leave customers and shareholders with less visibility into affected breaches.
Second-order effects
- Calls to require exceptional access in end-to-end encrypted products face a more tangible counterexample: attackers need only exploit the same privileged pathway that lawful users depend on.
- Telecom operators and suppliers may face greater scrutiny of how wiretap functions are isolated, monitored, and disclosed; later advice for people to use encrypted messaging underscores the gap between network-level interception systems and end-to-end communications protection.
Third-order effects
- If this pattern persists, lawful-intercept capabilities will increasingly be treated as a critical security boundary rather than a narrowly scoped compliance feature, raising the cost of proving that privileged access is contained.
- The policy debate may shift from whether a “secure backdoor” can be engineered to whether governments and providers can govern the systemic risk created by mandatory access mechanisms.
The trend: Salt Typhoon is one data point in a broader collision between governments' demand for exceptional access and the security reality that privileged entry points attract capable adversaries.