Going Dark: Why Law Enforcement Hacking Is the New Surveillance Frontier

Going Dark: Why Law Enforcement Hacking Is the New Surveillance Frontier

A provocative essay by cryptography engineer Matthew Green titled "Going Dark, and the era of law enforcement hacking" reached the Hacker News front page with 179 points and 109 comments. It argues that we're entering a new era of surveillance — one where encryption has won the debate over wiretaps, and law enforcement's response is to hack your devices instead.

The "Going Dark" Problem

For decades, law enforcement agencies have argued that encryption is creating a "going dark" problem — they can't intercept communications because end-to-end encryption (E2EE) means only the sender and recipient can read messages. The FBI, DOJ, and intelligence agencies worldwide have pushed for "exceptional access" — backdoors that would let them decrypt communications when they have a warrant.

The cryptography community has been nearly unanimous: you can't build a backdoor that only the "good guys" can use. Any weakness you build into encryption for law enforcement will eventually be exploited by criminals, foreign intelligence services, and hostile actors.

What Changed

Green's essay argues that law enforcement has quietly given up on the backdoor fight — and found a better alternative:

Instead of breaking encryption, they hack the endpoints.

If messages are encrypted in transit but decrypted on your phone, laptop, or tablet, then the device itself is the weakest link. Law enforcement doesn't need to break Signal's encryption if they can install spyware on your phone that reads the messages before they're encrypted, or after they're decrypted.

This approach has several advantages for law enforcement:

1. It works with any encryption: No need to weaken standards or fight with tech companies
2. It's targeted: You hack specific devices rather than breaking encryption for everyone
3. It's legal (in their view): Warrant-based device hacking is increasingly seen as constitutional
4. It's effective: Modern spyware (Pegasus, Predator, etc.) can compromise even fully patched devices

The Commercial Spyware Industry

The shift from wiretapping to hacking has created a booming commercial spyware industry:

• NSO Group (Israel): Maker of Pegasus, which can remotely compromise iOS and Android devices
• Cytrox (North Macedonia): Maker of Predator, used by governments worldwide
• Intellexa (Greece): An alliance of surveillance companies
• FinFisher (Germany): One of the earliest commercial spyware vendors

These companies sell spyware to governments — including authoritarian regimes. The Pegasus Project investigation revealed that NSO Group's clients used Pegasus to spy on journalists, activists, and political opponents in dozens of countries.

The Technical Arms Race

The shift to endpoint hacking has created a new technical arms race:

Defenders are building increasingly sophisticated device security:

• iOS Lockdown Mode
• Android's enhanced sandboxing
• Hardware security modules (Secure Enclave, Titan M)
• Memory-safe languages in kernel code
• Exploit mitigations (PAC, BTI, MTE)

Attackers are spending more on zero-day research:

• Zero-day brokers pay $2-3 million for iOS zero-click exploits
• Government exploit acquisition programs (like the US government's "zero-day vulnerability equities process")
• AI-assisted vulnerability discovery

The Policy Gap

Green's key argument is that we're having the wrong debate. While policymakers argue about encryption backdoors, the real surveillance is happening through device hacking — and there's almost no policy framework governing it.

In the US:

• Wiretapping requires a Title III warrant with strict minimization procedures
• Device hacking often falls under Rule 41 of the Federal Rules of Criminal Procedure, which has fewer safeguards
• There's no statutory framework specifically governing government hacking
• No requirement to disclose vulnerabilities discovered during hacking
• No clear rules on what happens to data collected from hacked devices

What This Means for You

For developers and security-conscious users, this shift has practical implications:

1. Endpoint security matters more than ever: Encryption in transit is necessary but not sufficient. If your device is compromised, encryption doesn't help.
2. Lockdown Mode is worth using: Apple's Lockdown Mode disables many features that could be exploited. It's a tradeoff between convenience and security.
3. Keep devices updated: Most spyware exploits known vulnerabilities. Patching is your first line of defense.
4. Be wary of targeted attacks: If you're a journalist, activist, or in a sensitive profession, assume you may be targeted. Use hardware security keys, separate devices for sensitive communications, and consider physical security.
5. Support encryption policy reform: The debate shouldn't be about backdoors — it should be about whether governments should be allowed to hack devices at all, and under what safeguards.

The Bottom Line

The "going dark" narrative was always a misdirection. Law enforcement isn't actually going dark — they're going offensive. The question isn't whether encryption will be broken (it won't be), but whether we'll build adequate legal and technical frameworks to govern the new era of state-sponsored device hacking.

Right now, the answer is no.

---

Based on Matthew Green's essay (179 points on Hacker News).