On Tuesday I made an argument in the abstract: forcing a provider to build a standing surveillance capability creates a vulnerability that adversaries will find, and a back door built for one is a back door for all. I want to spend today on why I wrote it that way, because it is not a thought experiment. The United States already ran this exact experiment at national scale — and lost.
Start with what CALEA did, since it is the hinge. The 1994 Communications Assistance for Law Enforcement Act did not merely say carriers must help with a given wiretap order. It required them to engineer their networks to be wiretap-capable in the first place — to build lawful-intercept systems into the switches, the portals and interfaces that let the government, on a court order, tap a line. That capability does not come and go with a particular case. It sits inside every major carrier, always on, waiting to be used. Surveillance by design.
Now the thing that happened. According to public reporting that broke in October 2024, a Chinese state-linked campaign — the one known as Salt Typhoon — penetrated major U.S. telecommunications providers and reached the systems used for court-authorized wiretapping. Not a side system. The lawful-intercept infrastructure itself: the CALEA-mandated capability built so that American law enforcement could listen with a warrant. The door the U.S. government compelled carriers to build is the door a hostile intelligence service is reported to have walked through.
And here is the part that should take your breath away, because the prize was not mainly the calls. Reporting indicated the intercepted communications themselves may not have been the point. The wiretap-request data was: the record of whom U.S. authorities are surveilling — which of China’s agents have been identified, which targets are under watch, and, by extension, which Russian, Iranian, and other operatives were exposed through those same systems. Susan Landau, in the Lawfare piece that prompted this post, called it an intelligence failure ‘roughly on par with putting Kim Philby in charge’ of the FBI’s Russia counterintelligence. The back door did not just leak conversations. It leaked the map of American counterintelligence.
Landau’s framing is the one I want to borrow, because it is exactly the § 12 point in a security researcher’s words: CALEA created what she calls an ‘architected security breach’ — a capability that exists in order to be exploited, which means it can be exploited by the wrong party just as easily as the right one. And the design around it made things worse, not better: rules that let wiretap data move over the internet rather than secured lines; automation that stripped out human oversight; interception orders stored more centrally; intermediary providers inserted into the delivery path; and a compliance standard, J-STD-025A, that reportedly lacked authentication for access to the call-content and signaling channels. CALEA § 301(b) did, on paper, require carriers to protect these systems. On paper. The security was never enforced to match the capability’s value as a target.
This is the whole case for § 12’s no-mandated-vulnerability rule, proven in the field. On Tuesday I said assistance has to mean handing the government what the provider already has and can reach under a warrant — not conscripting the provider to build a standing interception capability or to defeat its own security — because the vulnerability never stays in friendly hands. Salt Typhoon is the demonstration. The capability the United States mandated for the use of its own agents became an instrument available to a foreign one. There is no way to build a door that only the good guys can open. The lock does not know who is holding the key.
Which turns the government’s long-running ‘going dark’ argument on its head, using the government’s own history. For more than a decade the FBI and the Justice Department have pressed for exceptional access — back doors into encrypted systems — warning that strong encryption is letting criminals and terrorists ‘go dark.’ The CALEA breach is the counter-evidence, and it is not a hypothetical from a cryptographer’s slide deck. We already ran the experiment of mandating a lawful-access capability into the nation’s communications backbone, and a nation-state stole the keys to it. Every proposal for a new encryption back door now has to answer one question first: what, exactly, makes you confident this one will not be Salt Typhooned too? The burden of proof has flipped, and it flipped on real events.
Let me give the law-enforcement side its best answer, because there is a real one. The reply will be that the problem was not the capability but the security around it — build the back door properly, with hardware-token authentication, two-person control, isolation of the intercept software, and continuous red-teaming, and a mandated lawful-access capability can be made safe. There is genuine force here, and it is worth noting that Landau herself does not call for abolishing lawful intercept; she proposes exactly that kind of hardening. And the underlying need is real: law enforcement does have to be able to execute a valid warrant against a networked provider, or the warrant is a hollow right.
Two things answer it. First, ‘build it right’ has a track record, and the track record is CALEA. The duty to protect these systems was already in the statute, in § 301(b), and it did not produce secure systems — because the incentives to cut corners on an expensive, mandated capability that generates no revenue are structural, not accidental. Promising to do it right next time is promising to beat an incentive gradient that has already won once. Second, and more fundamental, there is a categorical difference between compelling a provider to hand over data it already holds and can access under a warrant, and compelling it to build and maintain a standing interception capability (or to break its own encryption). The first adds no attack surface that was not already there. The second manufactures a permanent, high-value target and points every adversary at it. Section 12 draws the line precisely between those two: compel access to what the provider has; forbid the mandated capability and the mandated vulnerability. Salt Typhoon is the reason the line sits exactly there.
And notice who ends up on the same side of that line, because it matters. This is not the familiar privacy-versus-security fight sorted by party. The civil-libertarian who distrusts a surveillance back door and the China hawk who fears a compromised telecom backbone want the same thing here: no standing vulnerability for an adversary to capture. The back door you build for your own government is a back door for your enemy’s. Refusing to mandate vulnerabilities is not the anti-law-enforcement position — it is the national-security position, and CALEA is the cautionary tale being written in the present tense.
That is why § 12 ended Pass 1 where it did. The provider in the middle is the choke point for everything the other eleven sections try to govern — and, it turns out, the choke point for the nation’s security too. Build surveillance into the infrastructure by law, and you have built a target by law. Next Tuesday, Pass 2 begins: the model statutory text, starting back at § 1 and a definitions section written to age well.
Leave a Reply