Matthew Green’s post sketches a shift in digital surveillance. For the last decade, law enforcement and intelligence agencies often got into phones and apps by buying or developing exploits, which let governments avoid the politically harder fight of forcing Apple, Google, and other vendors to build access in on purpose. His claim is that AI-assisted vulnerability discovery and repair may finally shrink the supply of remotely exploitable bugs enough that this workaround stops working. If that happens, the pressure does not go away. It moves from offensive hacking toward legislation, court orders, and private demands for built-in access.
Most of the useful discussion landed there, not on sympathy for law enforcement “going dark.” People largely accepted the political logic even when they rejected the article’s tone. The strongest pushback was technical. Commenters doubted the timeline and the scope. They argued that AI is also causing more code to be written, more features to ship, and more attack surface to appear, so “fewer useful bugs” is plausible only for narrow, mature targets like mobile platform internals, not software in general. That distinction mattered because phone compromise depends heavily on deep platform flaws,
secure enclave bypasses, and exploit chains that are much rarer than the average
SaaS bug.
The other important move was clarifying what a future backdoor would look like. Several comments pointed out that no one is imagining an AI sneakily missing an obviously malicious patch in a public repo. A real access regime would be implemented deliberately by a small set of executives and senior engineers, or imposed by law, then hidden inside restricted systems, update channels, or service-side APIs. In that world, the line between “backdoor” and “lawful access interface” gets thin. The practical weakness is not that the code looks buggy. It is that any special access path creates new credentials, secrets, and operators to compromise.
A few people also widened the lens. Governments already get a huge amount from cloud providers,
metadata, subpoenas, and targeted surveillance, so “going dark” is always relative. Others noted that if software in one country is presumed to contain government access hooks, other countries will respond with local stacks and bans on foreign products. The implication is not just more surveillance. It is a more fragmented software market, where trust is tied to jurisdiction as much as technical quality.
blog.cryptographyengineering.com