How the Wiretap Became the Backdoor: Salt Typhoon and the Thirty-Year Warning That Came Due

1. The door every phone company was required to build#

The single most sensitive database in American law enforcement is not a list of informants or a cache of intercepted calls. It is the list of who is being wiretapped -- and in 2024, a foreign intelligence service read it, by walking through a door that federal law had required every telephone company in the country to build. The same signed federal statement that disclosed the intrusion confirmed, in the government's own words, "the copying of certain information that was subject to U.S. law enforcement requests pursuant to court orders" ^[2].

For thirty years, a handful of cryptographers had said that door could not be kept safe. For thirty years, they were told that concern was hypothetical ^[3]. Then an actor that a coalition of US and allied agencies attributes to the People's Republic of China -- tracked as Salt Typhoon -- moved into the networks of at least nine US carriers and reached the systems those carriers use to fulfill court-ordered wiretaps ^{[1, 2]}. The hypothetical was over.

This article makes a single argument. A legally mandated access mechanism, built into the core of the telephone network and required by law to be always available yet invisible to its targets, is a structural single point of catastrophic failure -- a backdoor by any other name. Salt Typhoon is the moment that thirty-year-old warning became empirical.

One caution before we begin. CALEA, the 1994 law at the center of this story, is not an encryption backdoor. It escrows no keys and weakens no cipher; it requires carriers to be able to isolate and hand over communications on a lawful order ^[4]. What Salt Typhoon vindicates is the broader claim that unites the encryption-backdoor fight with the wiretap mandate: any mandated access path becomes an adversary's highest-value target -- a mapping the cryptographers themselves draw in print ^[5].

Keep that precise and the rest follows: where the mandate came from, how a wiretap is built, the compromises that rehearsed this disaster and were waved away, what Salt Typhoon reached, and why cryptography's own designers now call the failure structural and inevitable.

2. One fear, two answers: Clipper, CALEA, and the first Crypto War#

To understand why a wiretap is a backdoor, you have to go back to the two answers the US government gave, in the same two years, to the same fear.

In the early 1990s the telephone network was going digital and mobile at once. A wiretap had always been almost embarrassingly simple: a court order, a technician, and a pair of alligator clips on the target's copper line. Digital switching, cellular roaming, call forwarding, and conference calling broke every assumption behind that picture. A single conversation could be multiplexed among thousands of others and handed between switches mid-sentence; there was no longer one physical wire to clip ^[6]. The FBI's fear, articulated by Director Louis Freeh, was that lawful wiretaps would soon become technically impossible ^[7].

Two answers emerged. One built the government's access into the cipher; the other built it into the network.

flowchart TD
A["Wiretaps break as telephony goes digital and mobile"] --> B["One insight: move the access inside the system"]
B --> C["Encryption branch: build access into the cipher"]
B --> D["Network branch: build access into the carrier"]
C --> E["Clipper chip and the Escrowed Encryption Standard, 1993"]
D --> F["CALEA interception mandate, 1994"]
E --> G["Dead end: escrow field forged in 65536 tries, Blaze 1994"]
F --> H["Becomes federal law, then a global standard"]

The escrow branch breaks first#

Clipper was the encryption answer: announced by the Clinton White House on April 16, 1993, and formalized as the Escrowed Encryption Standard (FIPS 185) in February 1994 ^{[11, 8, 12]}. Rather than ban strong cryptography, the government would ship decryptable-on-warrant cryptography. A classified cipher (Skipjack) sat in tamper-resistant hardware; each device's key was split between two government escrow agents; and every call carried a LEAF so a warrant-holder could recover the session key. The whole enforcement guarantee rested on one detail: a receiving Clipper device refused to talk unless the LEAF's checksum -- all 16 bits of it -- validated.

In 1994, Matt Blaze, then at AT&T Bell Laboratories, showed that 16 bits was not nearly enough. A checksum that small has only 65,536 possible values ($2^{16}$), so an attacker can search for a rogue LEAF: one whose checksum passes, so a receiving device accepts it, but whose escrow field is garbage, so the government's later recovery yields nothing ^{[9, 13]}. That exhaustive search took about 42 minutes, practical for delay-tolerant, store-and-forward traffic like email or file transfer and enough to prove the protocol was broken, though too slow to defeat a live, real-time voice call. The safeguard the government had built to guarantee its own access was the exact thing that defeated it.

function checksum16(bytes) {
let a = 0x1d0f;
for (const b of bytes) a = ((a << 5) - a + b) & 0xffff;
return a;
}

// The receiver accepts any LEAF whose 16-bit checksum equals this family value:
const expected = 0x2a1b;
const bogusEscrow = [0xDE, 0xAD, 0xBE, 0xEF]; // NOT the real escrowed session key

let tries = 0, found = null;
for (let filler = 0; filler <= 0xffff; filler++) { // the entire checksum space
tries++;
const leaf = bogusEscrow.concat([(filler >> 8) & 0xff, filler & 0xff]);
if (checksum16(leaf) === expected) { found = filler; break; }
}

console.log(found === null
? "No hit this toy run -- but the search space was only 65536."
: "Rogue LEAF accepted after " + tries + " tries (filler 0x" + found.toString(16) + ")");
console.log("A 16-bit checksum has only 65536 possible values -- a brute-force search of about 42 minutes.");
console.log("The escrow field is garbage, so key recovery fails: enough to break the protocol, though too slow to defeat a live voice call.");

The lesson was permanent, the seed of everything that follows.

When you build a mandated access path into a communication system, the safeguard and the vulnerability become the same object. Blaze did not find a bug near Clipper's escrow field; the escrow field was the bug. Every later chapter of this story is a variation on that single discovery.

The network branch becomes law#

Clipper collapsed under Blaze's result and market rejection. But the other branch was already law. CALEA -- the Communications Assistance for Law Enforcement Act, also known as the Digital Telephony Act -- was enacted on October 25, 1994 ^{[14, 10, 7]}. Instead of touching the cipher, it shifted the technical burden of wiretapping into the network.

Its structure rests on three sections. Section 103 requires carriers to expeditiously isolate and deliver both the content of a target's communications and their call-identifying information. Section 105 allows interception only on lawful authorization, with a carrier employee in the loop. Section 107 grants a safe harbor to carriers that comply with a published industry standard ^{[4, 15]}.

One clause carries the whole distinction: Section 103(b)(3) exempts carriers from any duty to decrypt subscriber-supplied encryption -- the textual proof that CALEA is not an encryption backdoor ^[4]. The phrase "going dark" is anachronistic for 1994. Freeh's argument -- that digitization would defeat lawful wiretaps -- is his, but the slogan became standard FBI vocabulary around 2010 to 2011. Attribute the concept to Freeh, not the words. CALEA escrows no keys and weakens no cipher. It requires carriers to be able to hand over communications -- an interception mandate, a different mechanism from Clipper's key escrow, sharing only the deeper structure: a standing, always-available access path that only the good guys are supposed to use.

The cryptographers saw that shared structure immediately, and generalized it. In 1997, eleven of them -- Abelson, Anderson, Bellovin, Benaloh, Blaze, Diffie, Gilmore, Neumann, Rivest, Schiller, and Schneier -- published "The Risks of Key Recovery, Key Escrow, and Trusted Third-Party Encryption," arguing that any government-mandated access system would impose "substantial sacrifices in security and greatly increased costs" and was "beyond the experience and current competency of the field" ^[16].

Note who is not on that list: Susan Landau, who joins the argument in 2015. The roster matters, because the thirty-year clock this article keeps is carried by a continuity of the same authors. ※ Continuity is not a coincidence. Cryptography is a small field, and several of the people who designed its foundations are still the ones defending them in front of Congress.

Clipper collapsed; CALEA became law. The backdoor-in-the-cipher was beaten back, but the tap-in-the-network was just getting built. So what, exactly, does that tap look like?

3. How a wiretap is actually built#

Forget the van, the headphones, and the alligator clips. The modern wiretap is a standardized software architecture that ships in the switching and routing equipment of every carrier on earth, and it is engineered to do one thing perfectly: copy a specific person's traffic to the government without that person ever being able to tell.

The reference model is clean, and worth learning once, because everything in this story happens inside it. There are four functional pieces, defined in the North American CALEA safe-harbor standard J-STD-025 and in the international standards that generalized it: ETSI TS 101 671, maintained by ETSI's Technical Committee on Lawful Interception, and the 3GPP lawful-interception specifications, maintained by 3GPP SA3-LI ^{[15, 17, 18, 19, 20]}.

flowchart LR
IAP["Intercept access points in the switch and router fabric"]
ADMF["Administration function (ADMF): provisions the warrant"]
MF["Mediation and delivery function: isolates and formats the target traffic"]
LEMF["Law Enforcement Monitoring Facility (LEMF)"]
ADMF -->|X1 provisioning| MF
IAP -->|X2 metadata and X3 content| MF
ADMF -->|HI1 warrant and admin| LEMF
MF -->|HI2 metadata| LEMF
MF -->|HI3 content| LEMF

The pieces connect simply. An Administration Function (ADMF) provisions the intercept from a lawful order; intercept access points in the switching fabric feed the mediation and delivery function, which isolates and formats the target's traffic; and a Law Enforcement Monitoring Facility (LEMF) on the government side receives the result. Between carrier and government run three external handover interfaces: HI1 for the warrant and administration, HI2 for metadata, HI3 for content. In modern 3GPP networks (4G/EPS and 5G), internal interfaces named X1, X2, and X3 carry provisioning, metadata, and content inside the carrier before handover. The X1/X2/X3 labels are the 3GPP internal LI interfaces (TS 33.127/33.128, and the generic ETSI TS 103 221), used across 4G/EPS and 5G -- the internal counterparts to the external HI1/HI2/HI3. Do not assume the same names appear verbatim in the older ETSI TS 101 671 ^[21].

Metadata and content are different things, and the difference will matter enormously#

Notice that the architecture separates two deliverables, and hold on to the distinction, because it is the spine of everything Salt Typhoon reached. One is content -- the words of the call, the text of the message. The other is call-identifying information, the metadata: the numbers, the times, the durations, the cell towers.

The statute is built around three load-bearing sections; a later fight turns on exactly one of them.

Now step back and look at what this architecture is, as a security object. It is standardized, so an adversary who learns it once can attack it everywhere. It is always on, because the capability has to be ready the instant a warrant arrives. It is high-privilege, because it can reach into any subscriber's traffic. It sits at the dead center of the network, at the mediation function. And it is deliberately engineered to be invisible to the target -- which means it is also invisible to the people best placed to notice when it is being abused.

And the mandated surface only grew. The FBI's late-1990s "punch list" pressed additional interception capabilities into the standard, though a court later trimmed the most aggressive ^[22], and in 2005 and 2006 the FCC extended CALEA to facilities-based broadband and interconnected voice over IP -- an expansion the D.C. Circuit upheld ^{[23, 24]}. Every extension multiplied the places the same high-value interface must live, which is why the attack surface would look so different three decades later.

One boundary before we move on, because it is easy to blur. The mediation and handover surface described here is not the SS7 and Diameter signaling that carriers use to route calls and roaming between each other. That inter-carrier signaling is a separate, in-band, trust-by-default surface with its own abuse history ^[25]; it is adjacent to the CALEA machinery, and an attacker can move between the two, but it is not the mandated backdoor. We keep it in its own lane and return to it shortly.

A capability this powerful, this standardized, and this invisible has one obvious property: it is the most valuable thing in the network to steal. Had anyone ever actually stolen it? They had -- more than once, and almost nobody listened.

4. Dress rehearsals: three decades of the plumbing turned around#

Long before Salt Typhoon, the lawful-intercept machinery had already been turned against its owners -- at least twice, in ways that pre-enacted the 2024 catastrophe almost scene for scene. Each was a warning. Each was explained away.

timeline
title Thirty years from Clipper to the reckoning
1993 : Clipper chip announced, key escrow
1994 : CALEA enacted : Blaze breaks the escrow field
1997 : The Risks of Key Recovery statement
2004 to 2005 : The Athens Affair
2010 : Operation Aurora reaches a court-order compliance system
2015 : Keys Under Doormats
2024 : Salt Typhoon disclosed
2025 : Blaze testifies to Congress : FCC rule adopted then rescinded
2026 : FBI declares a major incident on its own collection system : Senate oversight finds eviction unproven

Athens, 2004: the tap becomes the weapon#

Sometime in 2004, unknown intruders compromised the mobile switches of Vodafone Greece. These were Ericsson AXE exchanges, and like every modern switch they shipped with a built-in lawful-intercept subsystem -- Ericsson called it the RES, the remote-control equipment subsystem. The attackers did not build a wiretap; they turned on the one that was already there.

They installed roughly 29 blocks of patched code that drove the RES directly, bypassing the auditable management layer (the IMS) that Vodafone had never licensed. The rogue software hid its own processes and could disable the transaction log -- and the alarm that was supposed to fire when the log was touched ^[26].

For months, about 100 of the most senior people in the Greek state were wiretapped through their own carrier's lawful-intercept feature: the Prime Minister, Kostas Karamanlis, his defense, foreign, and justice ministers, and a line at the US embassy in Athens. Costas Tsalikidis, the Vodafone network-planning engineer whose work touched the affected systems, was found dead in his apartment on 9 March 2005, the day before the wiretapping was disclosed to the Greek government. His death was never satisfactorily explained and remains one of the most disquieting loose ends in the case. Vassilis Prevelakis and Diomidis Spinellis, who wrote the definitive forensic account for IEEE Spectrum in 2007, noted that it was the first rootkit ever observed on a special-purpose telephone switch ^[26].

The lesson was exact, and it is the same one Blaze had drawn from Clipper, now proven in a live network: the tap itself can be the weapon, and a log the intercept operator can silently erase is worth nothing.

Why was the warning shrugged off? Because no one was ever caught. The Spectrum authors end with a flat admission: "We still don't know who committed this crime" ^[26]. With no attributable culprit, Athens read as a freak foreign incident rather than a structural indictment of the mandated capability sitting in American switches too.

Aurora, 2010: the target list leaks first#

The second rehearsal cut even closer to what Salt Typhoon would eventually do. In early 2010 Google disclosed that it had been breached by a China-linked operation later called Operation Aurora. Google's own statement described stolen intellectual property and compromised activist Gmail accounts.

But within weeks, Bruce Schneier reported a more unsettling detail: the attackers had reached the system Google built to comply with US intercept orders -- the "backdoor access system" for lawful surveillance requests ^[27]. In 2013 the Washington Post, citing US officials, reported that the intruders had accessed a database of court orders, apparently to learn which of their own agents were under US surveillance -- what one official called "brilliant counterintelligence" ^{[28, 29]}.

That is the whole plot of Salt Typhoon, fourteen years early. The most valuable thing in a compromised lawful-intercept system is not the content of anyone's calls. It is the list of who is being watched. The Aurora compliance-database detail is disputed. Google never publicly confirmed it; the claim is sourced to anonymous US officials, and Microsoft's David Aucsmith, quoted in early reporting, later walked back his remarks. That very deniability is part of why the warning was so easy to discount. A mandated-compliance surface does not just expose targets' data; it exposes counterintelligence -- who is watching whom.

In January 2010, Schneier fused Aurora, Athens, and CALEA into a single sentence that reads today like a prophecy.

"An infrastructure conducive to surveillance and control invites surveillance and control, both by the people you expect and by the people you don't." -- Bruce Schneier, 2010

The signaling surround, and a note on categories#

There is a third surface worth naming precisely, because it is adjacent to the CALEA machinery and is constantly confused with it.

There is even an encryption-branch echo in this period. In 2015, researchers found that unauthorized code in Juniper's ScreenOS had swapped the secret constant in a Dual_EC random-number generator, so that whoever knew the substituted value could passively decrypt VPN traffic -- an inserted backdoor quietly repurposed by a second party who simply re-swapped the secret ^[30]. It is the cipher-side twin of the Athens lesson: a backdoor built for one party is portable to another. Different mechanism, identical structure.

Every element of Salt Typhoon had already happened in miniature: the weaponized tap, the leaked target list, the invisible dwell time. All that was missing was a nation-state willing to do it at national scale. In 2024, one arrived.

5. Salt Typhoon: the argument becomes empirical#

In early October 2024, a Wall Street Journal report reframed what had looked like just another intrusion. The story was not that a sophisticated actor was living in American carrier networks -- that had been reported for weeks. It was that the actor had reached the systems US carriers use to fulfill court-ordered wiretaps ^[31]. Within days the connection to the thirty-year argument was explicit in the trade press: the 1994 backdoor law had come back to bite, and Matt Blaze was on the record calling the breach "absolutely" inevitable ^[32]. The hypothetical was over.

The facts arrive at three different levels of confidence, and it matters which is which.

What is confirmed, and by whom#

Start with the signed federal record, the highest tier. A joint statement from the FBI and CISA confirms that PRC-affiliated actors compromised multiple telecommunications companies and achieved three things: "the theft of customer call records data," the compromise of "private communications of a limited number of individuals who are primarily involved in government or political activity," and -- the sentence that reframes the incident -- "the copying of certain information that was subject to U.S. law enforcement requests pursuant to court orders" ^[2]. That last phrase is the target list, confirmed at advisory level.

Next, the on-record official characterization. In a December 27, 2024 press gaggle, Deputy National Security Advisor Anne Neuberger said China had compromised "now nine telecom companies," which is why the actor had "the capability to geolocate millions of individuals, to record phone calls at will." Crucially, she also said the number of individuals whose content was actually collected was "probably less than 100" ^[1]. Read those two facts together and the shape of the breach is clear: it was overwhelmingly a metadata event, with a small content tail.

Then the press tier, which must not be promoted to the first two. Reporting citing officials named the carriers -- Verizon, AT&T, Lumen, and later T-Mobile, Charter, Consolidated, and Windstream ^{[31, 34]}. Press accounts citing an anonymous industry source put the number of affected subscribers at over a million, concentrated around Washington, D.C. "Over a million" is a press figure attributed to an anonymous source. The strongest on-record government statement is Neuberger's: the actor had the capability to geolocate millions and record calls at will ^[1]. The distinction between a demonstrated capability and a confirmed count is exactly the kind of thing this incident's reporting kept blurring. And reporting named specific content targets -- among them the campaigns of Donald Trump and JD Vance, and staff on the Harris campaign ^[35]. Keep those in the press tier; they are credible, but they are not in a signed advisory.

sequenceDiagram
participant A as Salt Typhoon actor
participant R as Carrier backbone and edge routers
participant P as Wiretap provisioning and mediation systems
participant D as Collected data
A->>R: Compromise and modify routers for persistent access
R->>P: Pivot to the systems that service court-ordered wiretaps
P->>D: Bulk call and text metadata for millions
P->>D: Content for a limited set of high-value targets
P->>D: The list of who the government was intercepting
Note over A,P: The actor serviced the wiretap requests, it did not become the tap

The mechanism deserves the same care as the scope. The joint advisory describes actors who modified large backbone routers and provider-edge and customer-edge routers "to maintain persistent, long-term access" ^[33]. From that foothold they reached the provisioning and delivery surface -- the systems used to service CALEA requests. This is hedge number three: the attackers compromised the machinery that fulfills wiretap orders. They did not, in the confirmed record, "become the tap" in real time on arbitrary lines. The precise claim is damning enough without exaggeration.

Why "just metadata" is the wrong sigh of relief#

Because the content tail was small, a natural reaction is relief: most people's calls were not heard. That reaction gets the threat backwards. Metadata is not the harmless residue of a communication; it is often the communication's most legible summary. You do not need to hear a word to reconstruct a life.

// Each record is metadata only -- NO call content.
// Fields: [hourOfDay, cellTower, calledParty]
const cdrs = [
[7,  "TOWER_HOME",  "coffee-shop"],
[8,  "TOWER_HWY",   "spouse"],
[9,  "TOWER_WORK",  "boss"],
[12, "TOWER_WORK",  "cardiology-clinic"],
[12, "TOWER_WORK",  "cardiology-clinic"],
[13, "TOWER_WORK",  "pharmacy"],
[19, "TOWER_HOME",  "spouse"],
[23, "TOWER_HOTEL", "unknown-mobile"],
[23, "TOWER_HOTEL", "unknown-mobile"],
[2,  "TOWER_HOTEL", "unknown-mobile"]
];

function mode(xs) {
const c = {}; let best = null;
for (const x of xs) { c[x] = (c[x] || 0) + 1; if (best === null || c[x] > c[best]) best = x; }
return best;
}

const home = mode(cdrs.filter(r => r[0] <= 7 || r[0] >= 19).map(r => r[1]));
const work = mode(cdrs.filter(r => r[0] >= 9 && r[0] <= 17).map(r => r[1]));
const health = cdrs.filter(r => /clinic|pharmacy|cardiology/.test(r[2])).length;
const lateHotel = cdrs.filter(r => (r[0] >= 22 || r[0] <= 4) && r[1] === "TOWER_HOTEL").length;

console.log("Home area:   " + home);
console.log("Workplace:   " + work);
console.log("Health:      " + health + " contacts with cardiology/pharmacy -- a medical condition, inferred with zero content");
console.log("Off-hours:   " + lateHotel + " late-night calls to one number from a hotel tower");
console.log("Not one word was heard. The pattern told the story anyway.");

And the target list is the sharpest edge of all. Exposing whom the US government is surveilling under court order is not a variation on eavesdropping; it is a distinct and far worse category of harm. Susan Landau named the magnitude within weeks.

"If Chinese hackers have indeed accessed the court-ordered wiretapping requests, we have an intelligence failure roughly on par with putting Kim Philby in charge of the FBI's Russia counterintelligence office." -- Susan Landau, 2024

Landau's judgment, in the same essay, was blunter still: the breach "almost certainly occurred as a result of" CALEA ^[5].

The escalation reaches the government's own side (2026)#

The story did not end with the carriers. Two years after the wiretap-provisioning breach, the same category of harm surfaced one step deeper in the surveillance chain. In 2026 the FBI classified a suspected foreign intrusion into one of its own systems -- an unclassified store of pen-register and trap-and-trace surveillance returns, plus personally identifiable information on the subjects of FBI investigations -- as a "major incident" under the Federal Information Security Modernization Act, and notified Congress ^{[36, 37]}.

An on-record FBI spokesperson said the access was "obtained through a third party" and that the bureau was following "the required steps under FISMA, including notifying Congress" ^[37]. Investigators began probing abnormal activity on February 17, 2026, and determined that surveillance targets' phone numbers had been exposed ^[37].

Where the 2024 disclosure concerned the carrier systems that service CALEA requests, this reached the collection side of the handover -- the monitoring party's own records. That is a more severe place for the failure to land: not the content of calls, but the record of who was being watched. The signature harm is, once more, the target list -- realized this time against the government's own files.

Senator Mark Warner drew the through-line out loud: "From Salt Typhoon to Stryker to now this reported breach at the FBI, the pattern is clear: our adversaries are probing for weaknesses, and they're finding them" ^[38].

A nation-state -- or something moving exactly like one -- had done, at the scale of a continent, exactly what a handful of cryptographers had spent thirty years warning was inevitable. The only question left was whether the field would say so out loud.

6. The structural argument, now proven#

Why was Salt Typhoon "inevitable"? Not because the attackers were superhuman -- the response guidance pointedly notes "no novel activity," only the exploitation of existing weaknesses ^[39]. It was inevitable because a mandated access mechanism has three structural properties that no amount of engineering removes, and Salt Typhoon exercised all three at once.

The canonical statement of those properties is "Keys Under Doormats," published in 2015 by fifteen of the field's most senior cryptographers and security researchers ^[3]. Its argument is not a slogan; it is three concrete claims.

First, mandating exceptional access forces systems to abandon security best practices -- forward secrecy, for instance -- and piles on complexity, and, as the authors put it, complexity is the enemy of security. Second, it creates concentrated, high-value targets: the access capability becomes the single most valuable thing in the system to attack. Third, it is an unsolved authorization problem -- nobody knows how to build access that is usable by authorized parties yet reliably unavailable to a sufficiently resourced adversary.

Look at the roster of "Keys Under Doormats" and you see the thirty-year clock made concrete. It is the same core group that wrote the 1997 key-recovery statement -- Abelson, Bellovin, Blaze, Diffie, Rivest, Schneier and others -- now joined by Susan Landau, Matthew Green, Michael Specter, and Daniel Weitzner ^{[3, 16]}. The people who designed much of the cryptography the internet runs on have been making the same argument, in the same terms, since before the first smartphone.

flowchart TD
A["Mandated access capability built for authorized use"] --> B["Standardized across every carrier"]
A --> C["Always on and high-privilege"]
A --> D["Hidden from the target by design"]
B --> E["One learned interface attacks many networks"]
C --> F["Maximal payoff concentrated at a fixed location"]
D --> G["The parties best placed to detect abuse are blinded"]
E --> H["Single point of catastrophic failure"]
F --> H
G --> H

Put the three claims together and they collapse into one.

A mandated access mechanism is a single point of catastrophic failure. It concentrates maximal capability at a fixed, standardized, always-available location, operated by staff of wildly varying competence, and it must be hidden from the very people best placed to notice its abuse. Every property that makes it work for the government makes it a prize for an adversary. There is no version of the design where those pull apart.

The vindication, on the record#

The vindication here is not the author's opinion. It is testimony.

On April 2, 2025, the House Committee on Oversight and Government Reform held a hearing titled "Salt Typhoon: Securing America's Telecommunications from State-Sponsored Cyber Attacks." One of the witnesses was Matt Blaze -- the same person who had broken Clipper's escrow field thirty-one years earlier, now the McDevitt Chair in Computer Science and Law at Georgetown ^{[41, 42]}. His written testimony did not hedge.

"The interfaces provided by CALEA, and the services that have evolved around them, were a significant enabler of Salt Typhoon, a major cyber-intelligence operation against the United States." -- Matt Blaze, House Oversight testimony, 2025

Blaze's argument to Congress was precisely the structural one. The CALEA capability requirements, he noted, have changed little in three decades, but the infrastructure that must implement and protect them has changed radically, greatly expanding the attack surface, so that compromising telecommunications infrastructure is now little different from any other computer intrusion. His conclusion: "something like Salt Typhoon was inevitable, and will likely happen again unless significant changes are made," and requiring a wiretap interface in every switch serving every customer is "effectively an open invitation to foreign adversaries" ^[43].

Bruce Schneier drew the line even more starkly, framing the compromised systems as "the access that the Chinese threat actor Salt Typhoon used to spy on Americans" and connecting the whole chain -- Clipper's break in 1994, "Keys Under Doormats" in 2015, Salt Typhoon in 2024 -- into a single causal story ^[34].

And Susan Landau supplied the historical depth: two decades earlier, she, Bellovin, and Blaze had warned in print against extending CALEA onto internet telephony precisely because it would enlarge this surface ^{[44, 45]}, a through-line in Landau's scholarship on surveillance and security ^[46]. The warning was not new. Only the proof was.

The cryptographers had won the argument -- on the evidence. But winning an argument is not the same as having a better answer. Law enforcement's problem is real. So the honest next question is whether anyone has a workable alternative, and that turns out to be a genuinely two-sided fight.

7. Going dark versus keys under doormats#

It would be easy, and wrong, to end at "the cryptographers were right." Law enforcement's problem is genuine. With a lawful warrant in hand, investigators increasingly cannot execute it, because the content they are authorized to read is end-to-end encrypted. FBI Director James Comey put the modern case plainly in a 2014 address at Brookings: "We have the legal authority to intercept and access communications and information pursuant to court order, but we often lack the technical ability to do so." He asked industry not for a back door but for "a front door" -- lawful access designed in the open ^[40].

The cost he described is real; officials have pointed to thousands of locked devices in active investigations, and workarounds are expensive and uneven ^[47].

So the fair way to see the field is as five competing answers to one question -- how does a lawful authority get targeted access without turning the system into a single point of failure -- each making a different bet about where to put the capability.

The two modern "front door" proposals are worth naming, because they were serious attempts, not straw men. Ray Ozzie's "Clear" (2018) escrowed a device-unlock credential with the vendor, to be released under a lawful order; Matthew Green's technical walkthrough showed where the design was load-bearing, and a reviewer found a flaw in the live protocol during a 2018 protocol-review meeting ^{[48, 47]}. GCHQ's "ghost" (2018) proposed silently adding a law-enforcement participant to an encrypted chat, leaving the cryptography nominally intact while breaking the promise that you can see who is in the conversation ^[49].

Every one of these was rejected by the same expert community, for the same structural reason. The response to GCHQ's ghost proposal was an open letter from 47 signatories -- 23 civil-society organizations, 7 companies and trade associations (including major encrypted-messaging providers), and 17 individual security experts -- warning that it would undermine authentication and trust in the systems people rely on ^[51]. Apple built client-side CSAM scanning, then withdrew it in 2022, concluding it could not be done without imperiling the security and privacy of its users ^[52].

The definitive analysis of that approach, "Bugs in Our Pockets," was written by fourteen authors -- again overlapping heavily with "Keys Under Doormats" ^[53]. The EU's "chat control" proposal to mandate scanning of encrypted messages has repeatedly failed to reach a qualified majority and remains unresolved ^[54].

There is a fifth path, and it is the one that mandates no standing capability at all. Instead of building access into the cipher, the carrier, or every endpoint, law enforcement can obtain access case by case by exploiting a specific target's device -- the model of forensic vendors such as Cellebrite, and the route the FBI ultimately took in San Bernardino when it paid a contractor a reported $900,000 to open a single iPhone ^[47]. An EastWest Institute study, quoted in Wired, judged that aside from exceptional access this "lawful hacking" is "the only workable alternative" ^[47].

The path is worth naming precisely because of who named it. "Lawful hacking" was proposed and developed by Steven Bellovin, Matt Blaze, Sandy Clark, and Susan Landau in 2014 -- the same figures who anchor this article's thirty-year through-line -- who argued that using existing vulnerabilities is "on balance, preferable to adding more complexity and insecurity to online systems" ^[55]. The continuity is the point. Blaze broke Clipper's escrow field in 1994, Landau co-wrote "Keys Under Doormats" in 2015, and in 2014 the two of them, with Bellovin and Clark, named the leading alternative to a mandate. Even the standing counter-proposal to exceptional access comes from the mandate's own critics ^[55].

Its structural virtue is real: there is no central, always-on capability to steal, so the Salt Typhoon failure mode has nothing to attack. But its authors are ambivalent for an equally structural reason. It depends on a supply of unpatched vulnerabilities, which "creates a marketplace for so-called zero-day flaws" that "can be exploited by legal and nonlegal attackers" alike ^[47]. It trades a shared single point of catastrophic failure for a diffuse insecurity: everyone's devices are left a little more exploitable so that some can be reached. There is no free lunch on either side of this fight.

Then there is the irony that a novelist would be embarrassed to invent.

Notice what the comparison table actually shows. Three of the five approaches -- CALEA in-network intercept, the front door, and client-side scanning -- share the "catastrophic blast radius" row, and they share it for one reason: each builds a mandated, high-value, standing access capability, exactly the structure "Keys Under Doormats" indicts.

The remaining two escape that row by refusing to build such a capability, and each pays a different price. End-to-end encryption gives law enforcement no content access at all and leaves carrier-layer metadata exposed; lawful hacking preserves targeted access but subsidizes an insecure-by-design market in unpatched flaws. That is the genuine, two-sided cost, and it does not vanish on any row of the table. The evidence tips the scale against the mandated-capability approaches -- but "no one has built a safe golden key yet" is not the same claim as "no one ever can." Which is it?

8. Can safe exceptional access exist at all?#

Here is where honest writers overclaim, and I will not. There is no mathematical theorem that safe exceptional access is impossible, the way there is a theorem that comparison sorting takes $\Omega(n \log n)$ time. If someone tells you the cryptographers proved that a secure golden key cannot exist, they are overstating the case. The truth is more interesting -- and, for the policy question, more damning.

What exists is a structural impossibility argument, not a Godelian one. State it carefully. A globally deployed, standardized, always-on access path cannot be simultaneously (a) universally available to authorized parties across thousands of operators of varying competence, and (b) unavailable to a sufficiently resourced adversary who compromises just one of those operators.

The reason is that (a) and (b) are the same access-control problem wearing two hats: the system must enforce $\text{authorized}(p) \Rightarrow \text{access}(p)$ while somehow also guaranteeing $\lnot\,\text{authorized}(p) \Rightarrow \lnot\,\text{access}(p)$, and it must do so on a path deliberately hidden from the target -- which blinds exactly the people best placed to notice when the second guarantee fails. The Athens Affair is the proof-of-concept: the intercept ran invisibly for months precisely because the design required invisibility ^[26].

The premise that lets policymakers wave this away has a name.

NOBUS was defensible in an earlier era, when offensive and defensive signals intelligence ran on separate systems -- breaking the enemy's Enigma did not weaken your own SIGABA. It stops being defensible the moment both sides share the same commodity infrastructure, because then a vulnerability in the target's system is very likely a vulnerability in your own ^[57]. A CALEA mediation function running in standardized carrier equipment is exactly that kind of shared infrastructure. Salt Typhoon is the empirical refutation of NOBUS for this class of system: the access built for "us" was used by "them."

The honest counter-position deserves its hearing. Its proponents do not imagine an always-on bulk tap; they imagine access that is targeted to a specific order, audited with tamper-evident logs, and jurisdiction-bound. Each of those properties is individually approximable. The impossibility is in achieving all of them at once, at global scale, across operators of heterogeneous competence, on a path that must stay invisible to its targets.

Susan Landau sharpened why the analogy to a benign secret fails: a code-signing key "is used rarely, but the exceptional access key will be used a lot," and a key exercised constantly, across thousands of requests and operators, "will inevitably have huge gaps in security" ^[47]. Blaze's 1994 result -- that Clipper's own 16-bit escrow field ($2^{16}$ candidates) was forgeable -- was the first instance of the same lesson: the access mechanism becomes the vulnerability ^[9].

So state the epistemic status at exactly its strength: there is no impossibility theorem, but a thirty-year structural argument by a continuity of the same authors, now corroborated by two documented field compromises -- Athens and Salt Typhoon -- and by the empirical refutation of NOBUS for shared infrastructure. That is stronger than a conjecture and weaker than a theorem, and pretending it is either would be dishonest.

If the theory is settled at "structurally impossible to secure at scale," the practice is anything but. We still do not know exactly what was breached, who is obligated to secure it, or whether the mandated door can ever be made to fail safe.

9. What we still do not know, and what a fix even looks like#

The most honest thing to say about Salt Typhoon is that the story is not over -- and in a few places, the public record is being narrowed rather than widened.

Start with eviction. Can persistence in a modified router ever be proven gone? A sufficiently deep implant can survive reimaging and re-establish itself, and the joint advisory itself hedges that "any mitigation or eviction measures listed within are subject to change" ^[33]. Individual carriers asserted they were clear in late 2024 -- but weeks before those statements, the government had already warned that the breach was so significant it was "impossible ... to predict a time frame on when we'll have a full eviction" ^[58].

A year of oversight did not close the gap. At the December 2025 Senate Commerce hearing pointedly titled "Signal Under Siege," members found that the attack "has not been fully remediated" and that the FCC's own ruling "concedes that vulnerabilities 'are still being exploited,'" while the carriers had offered "no evidence" that the intruders were gone ^[59]. By February 2026, a Senate Commerce letter stated flatly that the Salt Typhoon hackers were "likely still inside" US telecommunications networks and "remain active and undeterred" ^[60]. The responsible posture is to treat "we reimaged it" as a hypothesis, not a result.

Then the question CALEA never answered: who is obligated to secure the mandated hole? The statute compels the capability in Section 103 but never clearly imposed an affirmative duty to protect it; Section 105 is thin. If the entity that mandates the access is not the entity obligated to secure it, then the highest-value surface in the network is nobody's clear responsibility -- which is precisely the gap Salt Typhoon walked through.

The forensic record is thinner than it should be, too, and in 2026 parts of it were narrowed on purpose. The Cyber Safety Review Board had opened an investigation into Salt Typhoon. In January 2025, the Department of Homeland Security terminated its advisory-committee memberships, effectively halting that review -- a decision security experts called "horribly shortsighted." The board remains disbanded, and the most authoritative public artifact is still the multi-nation advisory, not an independent post-mortem ^[64]. The carriers commissioned their own Mandiant assessments and then declined to release them to Congress; Mandiant did not hand them over, "apparently at the direction of AT&T and Verizon" ^{[60, 58]}.

More striking still, reporting indicates that two major operators' incident-response staff were "instructed by outside counsel not to look for signs of Salt Typhoon presence" -- a curtailment not of disclosure but of the hunt itself ^[65]. Policy is being made on incomplete facts, which is exactly why the "some specifics are still emerging" caveat is not a rhetorical hedge but a description of reality.

And the opacity now reaches the government's own side. The FBI's 2026 "major incident" -- the suspected intrusion into its pen-register and trap-and-trace store described earlier -- is officially acknowledged and congressionally notified, yet its full scope, its attribution, and its remediation all remain open: the access is tied to Salt Typhoon only as a suspected, similar-tradecraft link, and the bureau says remediation is "ongoing" ^{[37, 36]}. The same forensic fog that hangs over the carriers now hangs over the collection side of the handover.

Three technical frontiers remain genuinely open. The first is the metadata problem: even universal end-to-end encryption of content leaves the carrier-layer call-detail records, location, and IP-flow metadata that dominated this breach. Can communications be architected so that lawful, targeted access is possible without generating a bulk-metadata honeypot in the first place? No one has a deployed answer.

The second is the surface itself: the next-generation 3GPP lawful-interception standard (TS 33.128) standardizes the provisioning and handover interfaces further ^[21], and the adjacent SS7 and Diameter signaling surround remains a distinct, unowned problem ^[25]. The third is the middle-path question: after Clipper, Clear, ghost, and client-side scanning, is there any mandated-access design that survives expert red-teaming and the National Academies' 2018 evaluation framework? To date none has; the framework enumerates the questions every proposal must answer and records no proposal that answers them ^[66].

The open questions all reduce to one. If the mandated door cannot be made safe, what should the people who own the network -- and the people who use it -- actually do right now?

10. What to actually do#

Evidence is only useful if it changes behavior. Here is what Salt Typhoon means for the four people most likely to be reading this.

If you run a carrier network, treat the lawful-intercept mediation and provisioning surface as a crown-jewel asset, not routine plumbing. The December 2024 multi-agency guidance is unusually specific, and its advice reads like a point-by-point remedy for the failures in this article.

Two of those controls are worth making concrete, because they are exactly the pieces the Athens intruders defeated: a device must not be trusted to describe its own configuration, and logs must live somewhere the intercept operator cannot silently rewrite.

// Illustration of two hardening lessons, not a production tool.
function fnv(s) {
let h = 2166136261 >>> 0;
for (let i = 0; i < s.length; i++) { h ^= s.charCodeAt(i); h = Math.imul(h, 16777619); }
return (h >>> 0).toString(16);
}

// 1) The device must NOT be the source of truth for its own config.
const golden  = "intercept.mgmt=oob-only; logging=offsite; admin=least-priv";
const running = "intercept.mgmt=any; logging=local-only; admin=least-priv"; // tampered
if (fnv(running) !== fnv(golden)) {
console.log("ALERT: running config does not match the central source of truth");
}

// 2) Off-site logs must be continuous; a gap means someone tried to erase their tracks.
const offsiteSeq = [1001, 1002, 1003, 1006, 1007]; // 1004 and 1005 are missing
let gaps = 0;
for (let i = 1; i < offsiteSeq.length; i++) {
if (offsiteSeq[i] !== offsiteSeq[i - 1] + 1) gaps++;
}
console.log(gaps > 0
? "ALERT: " + gaps + " gap(s) in off-site logs -- evidence of tampering"
: "Off-site logs continuous");

If you defend a network, use the December 2024 guidance and the 13-nation advisory AA25-239A as a live threat-hunt checklist; the latter enumerates the actor's techniques against backbone and edge routers and the eviction caveats ^{[39, 33]}. Assume router persistence and, per the open problems above, treat any claim of complete eviction as unproven.

If you make policy, the design question CALEA left open is now unavoidable: who is legally obligated to secure the mandated hole? Before endorsing any new exceptional-access proposal -- front door, client-side scanning, or otherwise -- run it through the National Academies' 2018 framework, and note that no proposal to date has cleared it ^[66].

Then weigh the genuine going-dark cost that Comey described against the now-empirical systemic risk that Salt Typhoon demonstrated ^[40]. And weigh the one standing non-mandate option on the table -- lawful hacking, or targeted endpoint exploitation -- on its own honest terms: it removes the central single point of failure but subsidizes an insecure-by-design market in unpatched vulnerabilities, trading a concentrated risk for a diffuse one rather than erasing it ^[55]. The trade-off is real on every side; pretending any of them away is how we got here.

If you are an individual, "use Signal, iMessage, or encrypted RCS" is now literally US-government advice ^[56], and it is correct -- with one precise caveat. End-to-end encryption protects your call and message content. It does not erase the carrier-layer metadata -- who you called, when, and from where -- which is exactly the data that dominated the Salt Typhoon breach. Sealed-sender features reduce app-layer metadata ^[68] but cannot remove the records a carrier must generate to route and bill your traffic. Encryption is the one defense on this list whose value went up when the carrier core was compromised, which is why the agencies that once fought it now recommend it.

None of this makes the mandated door safe. It only makes the theft harder to hide -- which, given the last twenty years, is very nearly the whole game.

11. The wiretap was always a backdoor#

Go back to where we started: the most sensitive database in American law enforcement, the list of who is being wiretapped, read by a foreign intelligence service that walked through a door federal law had required every carrier to build.

Everything in between was the proof. The mandate was born in 1994 as one of two answers to the same fear, and the encryption answer broke on contact when Blaze forged Clipper's escrow field. The network answer became law and then a global standard: a standing, always-on, high-privilege access path at the center of every carrier, invisible to its targets by design.

It was turned against its owners in Athens in 2005 and rehearsed against Google's compliance system in 2010, and both warnings were waved away. Then Salt Typhoon did all of it at once, at national scale, and the same cryptographers who had warned about it for thirty years said so under oath.

The wiretap was always a backdoor. A standing, invisible, high-privilege access path at the center of the network does not become safe because the people who mandated it meant well. For thirty years that was an argument. Salt Typhoon made it a fact -- and it took a nation-state walking through the door to make the whole industry admit what a handful of cryptographers had been saying since 1994.

The precision matters to the end, so hold the four distinctions the evidence rests on: this was an interception mandate, not an encryption backdoor; the attackers serviced the wiretap systems rather than becoming the tap; the SS7 signaling surround is a different surface; and the attribution, while probabilistic, is as strong as attribution gets.

Thirty-one years, one argument, and finally the evidence to close it. For the longer history of the going-dark and exceptional-access debate that this piece resolves with a single incident, see the companion article in this series.