The Historical Trajectory of the Going Dark Debate
The "Going Dark" metaphor, popularized by former FBI Director James Comey, suggests that law enforcement’s ability to conduct court-authorized surveillance is being extinguished by the ubiquity of strong encryption. However, the authors argue that this debate is not a single, continuous event but rather a series of distinct "rounds," each defined by different technological paradigms and policy challenges.
Round 1: The Crypto Wars of the 1990s
The first round of the encryption conflict centered on the availability of strong cryptography to the general public. During this era, the United States classified high-level encryption as a "munition" under International Traffic in Arms Regulations (ITAR). This led to a legal and political battle over export controls, with the government attempting to mandate the "Clipper Chip"—a hardware-based encryption system with a built-in backdoor for federal access. This round concluded in 1999 when the U.S. government largely abandoned export controls, recognizing that American software companies were being disadvantaged in the global market by foreign competitors who faced no such restrictions.
Round 2: The Golden Age of Surveillance (2010–2015)
The second round emerged as the internet transitioned to widespread "encryption-in-transit" (such as HTTPS). While data was protected while moving between a user and a server, it was typically stored in plaintext or with provider-managed keys on the server side. The authors describe this period not as a time of "going dark," but as a "golden age of surveillance." During this era, cloud providers like Google, Facebook, and Microsoft held the keys to user data, allowing them to comply with lawful access requests. The volume of metadata—location history, contact lists, and timestamps—available to investigators reached unprecedented levels, far outweighing the loss of some real-time communication content.
Round 3: The Rise of End-to-End Encryption (2016–Present)
The current round is defined by the mass adoption of E2EE in consumer messaging services like WhatsApp, Signal, and iMessage. Unlike encryption-in-transit, E2EE ensures that only the sender and the intended recipient hold the cryptographic keys necessary to decrypt the content. In this scenario, the service provider cannot access the plaintext even when served with a warrant. This shift has prompted a renewed push for legislative interventions, including "client-side scanning" and "ghost participant" mandates, intended to give authorities access to private communications.
Technical Scenarios and the Reality of Lawful Access
A primary contribution of the paper is the identification of five technically distinct scenarios for how E2EE is implemented in the real world. This taxonomy challenges the binary view that encryption either works perfectly or is completely broken by a backdoor.
- Pure End-to-End Encryption: The idealized model where keys are generated and stored only on user devices, with no external recovery mechanism.
- E2EE with Cloud Backups: Many users opt to back up their encrypted chats to services like iCloud or Google Drive. Often, these backups are not encrypted with the same end-to-end rigor, providing a "side door" for law enforcement to access message history.
- Managed E2EE in Enterprise Environments: Corporations often use E2EE for internal security but retain administrative keys to ensure they can comply with regulatory audits or legal discovery.
- E2EE with Client-Side Scanning: A controversial middle ground where content is scanned for prohibited material (such as child sexual abuse material, or CSAM) on the device before it is encrypted and sent.
- Ephemeral or Metadata-Rich E2EE: Systems where the message content is protected, but the "envelope" information—who talked to whom, when, and for how long—remains accessible to providers and authorities.
By breaking down these scenarios, the authors demonstrate a "substantial gap" between the political rhetoric of "going dark" and the practical reality of modern investigations. They argue that while some content is indeed harder to reach, the total ecosystem of digital evidence remains vast.
The Integration of E2EE in Modern Infrastructure
The paper emphasizes that E2EE is no longer just a feature of privacy apps; it is deeply embedded throughout the modern technology stack. Technologies such as Transport Layer Security (TLS), Secure Shell (SSH), and Virtual Private Networks (VPNs) rely on the same fundamental principles of encryption to secure global commerce and government operations.
Furthermore, the authors highlight the emergence of "Zero Trust Architecture" (ZTA). In a Zero Trust model, no user or device is trusted by default, even if they are inside a corporate or government network. Every communication must be encrypted and authenticated from end to end. Notably, Zero Trust is now a legal and regulatory requirement in many jurisdictions. In the United States, Executive Order 14028 mandates the federal government’s transition to Zero Trust, while the European Union’s NIS2 Directive sets similar high-security standards for critical infrastructure.
The authors warn that any law broadly limiting or weakening E2EE would create a fundamental legal conflict. Governments would essentially be mandating E2EE for cybersecurity on one hand while demanding its degradation for law enforcement access on the other. This "security vs. access" paradox threatens the stability of the digital economy, as a backdoor created for a "trusted" government can inevitably be exploited by malicious actors or adversarial nation-states.
The "Least Trusted Country" Problem
One of the most significant policy findings in the paper is the persistence of the "least trusted country" problem. Because software is global, a mandate for a surveillance backdoor in one country sets a precedent and a technical template for every other country.
If the United States or the United Kingdom successfully compels a provider to implement a mechanism for intercepting E2EE communications, they cannot logically or technically prevent an authoritarian regime from demanding the same access. This creates a "race to the bottom" for global privacy. Companies would be forced to choose between withdrawing from certain markets or compromising the security of their entire global user base to satisfy the requirements of the most repressive jurisdiction in which they operate.
Supporting Data and Market Impact
Current data supports the authors’ assertion that encryption is a prerequisite for economic activity. According to Google’s Transparency Report, over 95% of traffic across Google services is now encrypted via HTTPS. In the financial sector, encryption is the primary defense against the $10 trillion annual cost of cybercrime projected by 2025.
The paper notes that the "Golden Age of Surveillance" continues to expand despite the rise of E2EE. The "Internet of Things" (IoT) has introduced billions of new sensors into private spaces—smart speakers, connected cars, and wearable fitness trackers—most of which generate unencrypted or provider-accessible data that can be used in criminal investigations. This explosion of data points suggests that the "loss" of message content is being offset by a massive increase in other forms of digital evidence.
Official Responses and Global Legislative Trends
The publication of this research comes at a time of intense legislative activity. In the United Kingdom, the Online Safety Act has sparked debate over whether the government can order "accredited technology" to scan encrypted messages. In the European Union, the "Chat Control" proposal has faced significant pushback from member states like Germany and Austria, who argue that undermining encryption violates fundamental human rights.
Privacy advocates and tech industry groups have reacted to these developments by echoing the paper’s skepticism. Organizations like the Electronic Frontier Foundation (EFF) and the Center for Democracy and Technology (CDT) have argued that "client-side scanning" is functionally equivalent to a backdoor, as it breaks the premise of private communication. Conversely, law enforcement agencies, including the FBI and Europol, continue to maintain that E2EE creates "warrant-proof" spaces that facilitate serious crime.
Broader Implications and Conclusions
The authors conclude that the fundamental lessons of the previous rounds of the encryption debate remain valid in Round 3. The "Going Dark" narrative, while effective as a political slogan, fails to account for the "Golden Age of Surveillance" and the systemic risks of weakening cryptographic standards.
The implications of this research are clear: restricting E2EE would have severe consequences for cybersecurity, commerce, and the integrity of government operations. As Zero Trust becomes the global standard for protecting sensitive data, the push for "exceptional access" becomes increasingly untenable. The paper suggests that rather than trying to break encryption, policy focus should shift toward enhancing the ability of law enforcement to utilize the vast amounts of other digital evidence available in the modern era.
Ultimately, the "Third Round" of the encryption debate is a battle over the future of the internet’s architecture. As this paper demonstrates, encryption is no longer an optional feature but the very fabric of a secure, globalized society. Any attempt to unravel that fabric risks a catastrophic loss of trust and security in the digital age.
