A Key for Investigators Only — Who Else Finds the Key Under the Doormat?

A Door That Opened With a Warrant

On February 16, 2016, a U.S. court issued an order to Apple. It was an order to bypass the security features of an iPhone used by one of the perpetrators of a shooting in San Bernardino, California. Apple refused. Apple's argument was that unlocking a single mobile phone could not be done without undermining the safety of locks across the board. Apple publicly appealed that if a key capable of opening all mobile phones were created, the government or someone else could use it to track users or look into their data. The U.S. government dropped the lawsuit after hiring an outside contractor to access that phone (DOI: 10.1017/s0002930000016894).

From the perspective of investigative agencies, the request was simple. They wanted to open just one criminal's mobile phone, a single one permitted by the court. Telephone wiretapping had long been done that way. When a judge issued a warrant, investigative agencies listened to that phone's calls on the telecommunications network. Therefore, the idea of making one more investigator-only key that opens only when there is a warrant is natural. The owner's privacy is kept as usual, and the door is opened only under the exceptions set by law.

Two questions hang over this dispute. One is how much encryption actually blocks investigations, and the other is whether technology can build a door that opens "only then." This article looks at both, but mainly follows the latter question. When to issue a warrant and whether to mandate such a key by law are matters for politics and law to decide, and this article does not settle those answers.

Communications That Go Unheard Even With a Warrant

There is a reason investigative agencies want this key. Around 2012, strong encryption was quickly becoming common in data and voice communications. Traditional wiretapping, which listens in from the networks of telecom or internet companies, increasingly ran into these encrypted communications and correspondingly lost its effectiveness (DOI: 10.1093/idpl/ips025). This means there was an increase in communications where, even with a warrant, what you get from a wiretap is nothing more than unrecognizable ciphertext.

In messengers, this shift came all at once. A widely used messenger applied end-to-end encryption to all users in early 2016. Following the definition in "Encryption — The Content Is Locked, but the Record of Comings and Goings Remains", end-to-end encryption is a method where a message is locked on the sender's device and opened only on the receiver's device, preventing even the server that passes it between them from reading the contents. A paper examining investigative scenes noted that this measure immediately left investigators around the world in the dark. Since then, what could be obtained by wiretapping communication networks was limited to metadata—that is, information around the contents, such as who exchanged messages with whom and when (DOI: 10.1016/j.fsidi.2021.301132).

The conclusion of the same paper does not end in that darkness. The authors proposed a method of weaving together wiretapping with the decryption of messenger records inside a suspect's device, open-source intelligence analysis, and web browsing analysis. Across the various scenarios tested, this method made it possible to obtain conversation contents, including voice messages, and even locations in real time, and the authors concluded that investigative agencies could regain their footing through this method. The means featured in the abstract include access to the records and accounts on a suspect's device (DOI: 10.1016/j.fsidi.2021.301132). This means that while wiretapping alone became dark, there were other paths in investigations that could reach the device and the account.

Going dark is what investigative agencies call the situation where, even when wiretapping is legally permitted, the contents of communications or devices cannot actually be read because of encryption (DOI: 10.47152/rkkp.60.1.4). Responses largely split into two paths. One path is to mandate investigative agency access within cryptography, and the other is to legally permit investigative agencies to enter a target's device. The name attached to the former path is the subject of this article. Exceptional access is a mechanism built into the design from the start that allows investigative agencies to open locks that are normally opened only by their owner, under exceptions defined by law.

Opinions also differ on what filled the void left when wiretapping lost its effectiveness. The same 2012 paper saw government access as increasingly relying on new but limited methods, especially records stored in the cloud. It noted that countries split into those that hold such records and those that do not, with those that do not having to rely on the cooperation of those that do (DOI: 10.1093/idpl/ips025). On the other side, a 2015 report assessed that investigative agencies had meanwhile found new and more effective means to access much larger volumes of data (DOI: 10.1093/cybsec/tyv009). The two documents overlap to the extent that there are both places that went dark and places where other paths opened up. Just how dark things have gotten is revisited below in "Why Studies Diverge".

The Clipper Chip — A Chip That Carries Along a Copy of the Key

The U.S. government tried to make exceptional access the official standard in the 1990s. Key escrow is a method where a copy of the key that opens data is left in advance with a third party, such as the government. The Escrowed Encryption Standard introduced by the U.S. government put this method into a chip, which came to be commonly known as the Clipper chip. It was an encryption chip intended to protect private communications and data alongside government secrets (DOI: 10.1145/191177.191193).

The structure works like this. When two chips start a conversation, they agree on the key to use for this conversation and exchange a tag called the "Law Enforcement Access Field" along with it. Inside this tag, a copy of that conversation key is contained in an encrypted state. Leaving the key to unlock that copy with the government was what the name "key escrow" meant. It was a device intended to let investigative agencies read the plaintext of the conversation—that is, the original content before encryption was applied—once they unsealed that copy. The chip used a classified encryption method that was not made public and was housed in hardware designed to make tampering difficult. Several parts of the design were meant to make it impossible to use the chip without sending this tag (DOI: 10.1145/191177.191193).

An analysis from 1994 tested this guarantee. The analysis examined public protocols and prototype devices, finding ways for chips to perform encrypted communications with each other without sending a valid tag. The easier method worked only between two people who both decided to break the rules. A more complex method allowed even just one rule-breaking party to communicate with a normal user who followed the rules. The analysis also suggested ways to make the architecture deployed against such failures more robust (DOI: 10.1145/191177.191193). In the Clipper chip, the guarantee that investigative agencies could open it at any time was a guarantee that those who did not want it opened could bypass.

This debate returned two decades later. Comparing the arguments exchanged in the 1993 Clipper chip controversy and the 2016 Apple v. FBI case shows that the arguments for the side advocating exceptional access remained largely consistent between the two events, while the arguments for the side criticizing it were more diverse (DOI: 10.17645/mac.v5i1.805).

Keys Under the Doormat — Two Reports from 1997 and 2015

Over the years leading up to 1997, government agencies sought to maintain covert surveillance in new technological environments by making demands for "key recovery," "key escrow," and "trusted third-party" encryption. A report from that year gathered this family of demands together, attempting to map out the technical risks, costs, and implications of systems that allow governments to access cryptographic keys (DOI: 10.7916/d8gm8f2w).

In 2015, computer scientists and security experts gathered once again. Many of them were individuals who had participated in the 1997 study. The title of the report they produced is "Keys Under Doormats." The conclusion of the report is this: the harms that exceptional access demands by investigative agencies could cause will be greater today than they were 20 years ago, and because the economic and social costs arising from the fundamental insecurity of the internet are growing, proposals that alter the dynamics of online security must be handled with care (DOI: 10.1093/cybsec/tyv009).

One reason cited by the authors is that it clashes with design practices. Forward secrecy is a property that ensures past communications cannot be decrypted even if a long-term key is compromised later. The report wrote that exceptional access forces developers to reverse this design practice. This practice is meant to limit the damage to user privacy when a system is breached. They also viewed today's internet—consisting of millions of apps and services connected to the entire world—as too complex, making it highly likely that new investigative demands would introduce unanticipated and hard-to-detect problems (DOI: 10.1093/cybsec/tyv009).

If we apply the first reason to a single message, it looks like this (what the report said ended in the previous paragraph, and the explanation below is textbook theory). A messenger built with forward secrecy discards a key shortly after using it. Therefore, even if someone steals a long-term key months later, the key needed to open the ciphertexts of past conversations recorded in transit along the way no longer exists anywhere. Exceptional access demands the opposite. For investigative agencies to be able to open conversations no matter when a warrant is issued, a long-lasting key that can retrieve the keys to past conversations must be deposited somewhere. The place where that key is deposited is also the place where, if the system is breached, the past conversations of many users are stolen all at once. This is why the report described the purpose of that practice as "limiting damage when breached."

Who holds the deposited key is also an age-old objection. A cryptography paper from 1997 wrote down one of the main objections to key escrow like this: individual privacy comes to rely on excessive trust in investigative agencies, and even if today's government is trustworthy, if it changes tomorrow into a government that cannot be trusted, that government could recover the keys of all users at once (DOI: 10.1145/266420.266439).

Looking First Without Touching the Encryption — Client-Side Scanning

After key escrow met with backlash around the world, another approach that does not escrow keys was proposed (DOI: 10.48550/arxiv.2106.09820). Client-side scanning is a method where messages or photos are inspected inside the user's device before they are encrypted, notifying the outside only when they match what is being searched for. When the target being searched for is discovered, its existence and origin are exposed to investigative agencies; otherwise, almost no information leaves the device. Proponents argue that this is a solution to resolve the conflict between encryption and public safety. They claim it allows the investigation of serious crimes while leaving end-to-end encryption untouched (DOI: 10.1093/cybsec/tyad020).

The core tool of this scan is a special hash that compares photos. As explained in "What Is a Blockchain — Why a Ledger With No One in Charge Holds Up", a hash reduces any long text into a single short value of a fixed length. In a normal hash, changing even a single letter yields a completely different value. A perceptual hash is a hash that reduces a photo to a short value while making photos that look similar to the eye yield similar values. By matching the hash of my photo against the hashes of a list of already known illegal photos, one can tell whether they are similar without looking at the photo itself (DOI: 10.14722/ndss.2024.241401). Child sexual abuse material has been cited as a representative target. In 2021, Apple unveiled a method to scan photos on the device before uploading them to the cloud, and it received widespread criticism for creating risks to security, privacy, and freedom of expression (DOI: 10.1109/sp46215.2023.10179349; DOI: 10.1145/3531146.3533073).

Attack research followed right after. The results below were all produced by researchers in their own experimental environments and do not count accidents that occurred against real users.

The first is evasion. In one preprint (an open-server version), evasion attacks succeeded in over 99.9% of images while maintaining the image content, even under conditions where the system interior was unknown (DOI: 10.48550/arxiv.2106.09820). This means that tweaking the photo being searched for just a little can prevent it from getting caught on the list.

The second is match manipulation. In a study analyzing the scanning engine released by Apple, simply altering an image slightly made it possible to manipulate the hash value to either force or block a match. Based on these results, the authors considered that everything from hiding illegal photos to framing innocent users was possible. Making inferences about data contained on the device using only hash values also remained possible. The authors concluded that this technology in its current form is largely not ready to be used for robust client-side scanning and should not be used from a privacy perspective (DOI: 10.1145/3531146.3533073).

The third is hidden purposes. Proponents have argued that the risk is small because this technology addresses only the narrow scope of "finding already known illegal photos." However, the party supplying the hash algorithm was able to smuggle in a second purpose—recognizing the face of a specific individual—while keeping the illegal photo detection performance intact. This model recognized the target individual in 67% of cases, and its hidden purpose was turned on by placing a photo that looked illegal into the list. The authors raised concerns that such systems could turn billions of devices into tools for finding target individuals (DOI: 10.1109/sp46215.2023.10179310).

The fourth is location surveillance. In an experiment where the hash list was contaminated to cause it to single out photos taken in specific locations, contaminating 0.2% of the list yielded a surveillance success rate of over 30% (DOI: 10.14722/ndss.2024.241401). In this scan design, since the hash list is not disclosed to users (DOI: 10.1109/sp46215.2023.10179349), users cannot know what the party holding the list is actually looking for.

The authors of a security journal paper gathered these circumstances and argued as follows. Client-side scanning guarantees neither effective crime prevention nor the prevention of surveillance. The authors viewed that this method can fail, can be evaded, can be abused, and the help it gives to investigative agencies is problematic at best (DOI: 10.1093/cybsec/tyad020).

If You Loosen It, Surveillance; If You Tighten It, Evasion

Why these attacks become a problem together can be followed through a single photograph.

An illegal photograph is listed. Someone crops that photograph slightly and changes its brightness. For the hash to recognize this as the same photograph as well, the threshold for judging them as 「similar」 must be widened. However, according to the calculations in the earlier preprint, widening the threshold enough to make the attacks harder meant that more than 1 billion images per day were likely to be caught and have to be decrypted. The authors wrote that this raises strong concerns about privacy (DOI: 10.48550/arxiv.2106.09820).

Sturdier detection that catches even slightly altered photographs moves in the same direction as widening the threshold. The place surveillance experiment showed that the sturdier the setting for finding illegal photographs, the greater the likelihood under most conditions that it would also be used for place surveillance (DOI: 10.14722/ndss.2024.241401). Conversely, if you narrow the threshold, photographs tweaked slightly like the first attack slip right through.

Connecting the two experiments reveals a structure where widening the threshold increases the photos caught and the room for surveillance under most conditions, while narrowing it lets slightly tweaked photos slip through. However, this is simply us connecting the results measured by the algorithms and data chosen by the researchers, and neither experiment measured all three outcomes together using a single threshold. No study has shown that the relationship between the threshold and the attacks is the same in all designs.

Another Path Instead of a Key — Lawful Hacking and Restricted Access

One of the options most frequently discussed as an alternative path that does not put a door in encryption is for investigative agencies to step inside directly. Lawful hacking is an investigative method in which investigative agencies use tools to break into a target's computer or smartphone according to powers established by law, accessing the contents within. The point raised as an argument in support is that investigative agencies can obtain the information they are looking for without weakening encryption. The author of a 2020 paper covering this path suggested that such investigations appear essential in an increasingly connected society, while also noting that because several countries have already enacted related laws, we must understand the different security and privacy risks inherent in each regulatory approach (DOI: 10.36645/mtlr.26.2.exploring).

There is also opposition to this path. According to an overview examining government hacking practices in five countries, investigative agencies and government bodies argue that such tools are necessary to protect countries and citizens. Many non-governmental organizations and civil society groups oppose the method as overly intrusive, and worry that it could weaken encryption standards and jeopardize the safety of the internet (DOI: 10.1109/access.2018.2871762). In remote surveillance, the risk is also pointed out that investigative agencies can have unrestricted access to a target device over a long period. Therefore, a category has been proposed in which, instead of the entire contents, only the key required for decryption is extracted, and encrypted communications are wiretapped separately and unlocked with that key. This is a design aimed at minimizing the data brought from the device (DOI: 10.1016/j.fsidi.2024.301796).

There are also proposals to make exceptional access expensive in the first place. The starting point is that it has been difficult to create a system that grants a certain level of access to authorities while in practice preventing unlimited access. Without introducing a new third party, this design allows the government to recover target messages but imposes a heavy computational cost for each message. According to the researchers' initial analysis, a cost of 1,000 dollars to 1,000,000 dollars could be charged per message, and the researchers showed that this design can be easily added to various commonly used cryptographic tools (DOI: 10.1109/eurosp.2018.00028). The guarantee targeted by this design is that it opens "only at a high cost." It differs from "only for investigative agencies" in that anyone willing to pay the cost can open it, and because opening more messages becomes more expensive, the intention is to make mass surveillance difficult to use.

The idea of entrusting only a part of the key is older than this. A 1997 paper expanded "partial key escrow," which requires the government to find the remaining part through computation, to a public key environment. At the same time, it showed that other proposals suffered from the problem of allowing the government to find the key earlier than planned, making them no better than ordinary key escrow, and noted that its own method does not suffer from this problem (DOI: 10.1145/266420.266439).

Research aiming to fix device-side scanning also continues. Cryptographic protocols have been proposed that allow anyone to verify whether an external body has approved a hash list and whether a specific legitimate photo is absent from the list, and to notify wrongfully caught users later. The authors noted that trust in lists and trust in implementation cannot be completely resolved by technology alone, but that there is room for improvement through cryptography (DOI: 10.1109/sp46215.2023.10179349). One systematic review summarized that currently deployed methods generally sacrifice one aspect of end-to-end encryption. User reporting methods and metadata analysis largely preserve privacy but rely on user participation, whereas more automated methods like device-side scanning can harm privacy and are vulnerable to evasion. This review evaluated newly emerging cryptographic techniques and concurrently explored directions that do not weaken end-to-end encryption (DOI: 10.1109/isdfs65363.2025.11012061).

The proposals in this section—namely the category of extracting only keys, the cost-imposing design, partial key escrow, and publicly verifiable protocols—are all proposals by researchers and are not results that have been actually deployed and verified.

Why Research Findings Diverge

Public court judgment data in the Netherlands was used to test the "going dark" claim. This analysis started from the premise that the claim is not yet backed by empirical evidence. In cases that reached court, Dutch judges appeared to lead criminals who relied on end-to-end encryption to a guilty verdict just as often as those who did not. However, the authors stated that their data cannot conclude what impact end-to-end encryption had on the investigative stage (DOI: 10.1186/s40163-023-00185-4). This means cases where investigations stalled and never even reached indictment are not included in this data. What this study shows is, at most, the outcomes of cases that made it to court in one country.

The first reason for the divergence is that the measuring points differ. A review covering key extraction noted that classic tools like device seizure and wiretapping have been rendered powerless (DOI: 10.1016/j.fsidi.2024.301796), while the earlier messenger forensics paper reported recovering chat contents by combining various tools (DOI: 10.1016/j.fsidi.2021.301132). Court judgment data looks at the outcomes of cases that went all the way to court. The three measure different stages and conditions.

The second reason is what is placed as a threat. A 1998 law review paper put the needs of criminal investigation and foreign intelligence gathering first. Key recovery is difficult to implement, costly, and attacked by civil liberties groups, but satisfying the needs of investigative agencies requires a cost-effective compromise. The author believed that if the system followed existing electronic surveillance laws, it could balance individual privacy with government interests, and urged that the Parliament and the President quickly enact key recovery laws before encryption became widespread (DOI: 10.1080/13600869855487). A 1997 paper on partial key escrow acknowledges the risk of government key abuse as a starting point and seeks a form that mitigates that risk. Because political debate will not make the conflict between users and investigative agencies disappear, the realistic question is which form best guarantees privacy (DOI: 10.1145/266420.266439). A 2015 report and a paper criticizing client-side scanning weigh this together with third-party attackers targeting the keys or scanning devices left behind here. A study comparing the 2016 Apple v. FBI case to the Clipper Chip debate concluded that this debate must be approached from a broader security perspective that includes the threats of cybercrime and state hacking (DOI: 10.17645/mac.v5i1.805).

The third reason lies outside technology. Who sets the hash lists and who monitors them cannot be completely solved by technology alone, as the earlier verification protocol study noted (DOI: 10.1109/sp46215.2023.10179349). The law has also tried to fill this space. The intelligence community of five countries—the US, UK, Canada, Australia, and New Zealand, commonly known as the "Five Eyes"—has called this problem "going dark" over the decade leading up to 2023, and several jurisdictions have passed laws restricting access to end-to-end encryption (DOI: 10.1007/s10676-023-09707-9). Australia's 2018 Telecommunications and Other Legislation Amendment (Assistance and Access) Act placed restrictions against creating so-called "systemic weaknesses." One legal analysis concluded that while this restriction blocks the most blatant blanket backdoors, it is not a cure-all that solves all security concerns, and its practical effectiveness is likely to be low due to its complex content and procedures (DOI: 10.1016/j.clsr.2022.105659). A 2026 student law review paper analyzing the European Union's regulatory proposal to change child sexual abuse material detection from voluntary to mandatory criticized the proposal for assuming reliable scanning technology exists while ignoring unresolved security vulnerabilities (DOI: 10.15168/tslr.v8i1.3967).

A study that attempted to place the pro and con hypotheses of client-side scanning side by side and compare them noted that there is still no consensus on the best way to combat child sexual abuse material. The authors stated that they do not consider their own recommendations to be the "correct answer" or the final outcome of this debate (DOI: 10.1145/3655693.3655712).

What Technology Can Answer

The initial conventional wisdom was "you just have to make a key that opens only when there is a warrant." This sentence mixes two shares. "When there is a warrant" is the share of the law, which decides when the door may be opened. "Opens only then" is the share of technology, which ensures no one else can open it otherwise.

From the 1994 analysis of the Clipper Chip to the 2015 "Keys Under the Doormat" report and 2020s research on client-side scanning attacks, what these studies questioned is the latter share. The label of the Clipper Chip could be bypassed, the report saw that keys left in custody collide with the design where "even if compromised, past conversations are safe," and pre-decryption client-side scanning was shown in experiments to be vulnerable to evasion and surveillance while the authors noted even framing someone is possible. Proposals to build that share continue to follow.

There is also a basis on the side of investigative agencies' difficulties. Traditional wiretapping has lost its effectiveness, and what is obtained by wiretapping messengers has been limited to metadata since 2016. There are also reports that chat contents were recovered in investigations that reached devices and accounts. Whether that difficulty changed trial outcomes pointed to the side where a single country's court data did not change, but that data could not see the investigative stage.

So the boundary drawn by these evidences is this. For the guarantee that "only investigative agencies" can open, which was in the analyses gathered by this article, authors found counterexamples in the Clipper Chip and perceptual hashing. A design that charges a cost per message is a direction intended to make things openable not "only to investigative agencies" but "only expensively," and it is still at the proposal stage. Meanwhile, as another path for investigative agencies to use, lawful hacking has gained a legal framework in multiple countries, and that path also carries its own risks. Which risk to accept is decided outside of technology.

What end-to-end encryption hides and what it leaves behind is covered in "Encryption — The Content Is Locked, but the Record of Comings and Goings Remains". Like the hidden purpose of facial recognition, what the law has and has not decided when the state looks for people by their faces continues into "Facial Recognition and Surveillance — What the Law Has Not Decided".

Source Papers

• "Constructing Norms for Global Cybersecurity" (2016) — DOI: 10.1017/s0002930000016894 — On February 16, 2016, a U.S. court ordered Apple to bypass the security features of an iPhone 5C used by a San Bernardino shooter, which Apple refused (arguing that cracking one device would destroy the overall security of encryption), after which the FBI accessed the device via an outside vendor and the government dropped the lawsuit.
• "From real-time intercepts to stored records: why encryption drives the government to seek access to the cloud" (2012) — DOI: 10.1093/idpl/ips025 — As strong encryption spreads, traditional wiretapping loses effectiveness, shifting government access toward cloud-stored records.
• "Identifying interception possibilities for WhatsApp communication" (2021) — DOI: 10.1016/j.fsidi.2021.301132 — Full end-to-end encryption in a messenger in early 2016 left investigators in the dark, restricting wiretaps to metadata. By combining wiretapping, device record decryption, open-source intelligence, and web access analysis, chat contents, voice messages, and locations were obtained in real time in a test scenario, leading to the conclusion that law enforcement could regain its footing.
• "COMMUNICATIONS ENCRYPTION AS AN INVESTIGATIVE OBSTACLE" (2022) — DOI: 10.47152/rkkp.60.1.4 — The "going dark" problem where end-to-end encryption blocks lawful intercept capabilities, with responses splitting into two branches: mandatory exceptional access and legalized targeted hacking.
• "Protocol failure in the escrowed encryption standard" (1994) — DOI: 10.1145/191177.191193 — The Clipper chip (EES) sends and receives a law enforcement access field containing an encrypted copy of the conversation key. Two classes of techniques for communicating without the correct field were found, along with techniques to reinforce the architecture.
• "Clipper Meets Apple vs. FBI—A Comparison of the Cryptography Discourses from 1993 and 2016" (2017) — DOI: 10.17645/mac.v5i1.805 — Arguments supporting exceptional access largely persisted between the two events while criticism arguments diversified. Concludes that a broader security perspective including cybercrime and state hacking is needed.
• "The Risks of Key Recovery, Key Escrow, and Trusted Third-Party Encryption" (1997) — DOI: 10.7916/d8gm8f2w — Outlines the technical risks, costs, and implications of government demands for key recovery, key escrow, and third-party encryption.
• "Keys under doormats: mandating insecurity by requiring government access to all data and communications" (2015) — DOI: 10.1093/cybsec/tyv009 — An expert group including many participants from the 1997 study: the harms of exceptional access would be larger than 20 years ago, forcing the reversal of forward secrecy practices and introducing unexpected problems into the complex internet. Law enforcement has found new means to access more data in the meantime.
• "Verifiable partial key escrow" (1997) — DOI: 10.1145/266420.266439 — A major counterargument to key escrow (today's trustworthy government can have all keys recovered by tomorrow's government). Extends partial key escrow to public keys and shows early recovery problems in existing proposals. The realistic question is finding the form that best guarantees privacy.
• "Bugs in our pockets: the risks of client-side scanning" (2024) — DOI: 10.1093/cybsec/tyad020 — Authors' argument (opinion piece) that on-device scanning guarantees neither crime prevention nor surveillance prevention, can fail, be evaded, or be abused, and investigative support is at best problematic.
• "Experimental Analyses of the Physical Surveillance Risks in Client-Side Content Scanning" (2024) — DOI: 10.14722/ndss.2024.241401 — Perceptual hashing checks whether two images are visually similar. A 0.2% hash list contamination yields over 30% place surveillance success rates, with more robust detection increasing the possibility of surveillance in most settings (experiment).
• "Public Verification for Private Hash Matching" (2023) — DOI: 10.1109/sp46215.2023.10179349 — Apple's 2021 cloud photo scanning proposal was criticized for security, privacy, and freedom of expression risks. Proposes a public verification protocol for list approval, non-inclusion of specific content, and false positive notification, concluding that trust problems cannot be fully solved by technology alone but room for cryptographic improvements exists.
• "Adversarial Detection Avoidance Attacks: Evaluating the robustness of perceptual hashing-based client-side scanning" (2021, preprint) — DOI: 10.48550/arxiv.2106.09820 — Under black-box conditions, evasion attacks succeeded on over 99.9% of images while preserving content. Widening the threshold enough to make attacks difficult would require decrypting over 1 billion images daily.
• "Learning to Break Deep Perceptual Hashing: The Use Case NeuralHash" (2022) — DOI: 10.1145/3531146.3533073 — Images can be subtly altered to force or prevent hash matches, allowing anything from concealment to framing, and data can also be inferred from hashes. Authors' conclusion that in its current form it is largely unprepared for robust on-device scanning and should not be used from a privacy perspective.
• "Deep perceptual hashing algorithms with hidden dual purpose: when client-side scanning does facial recognition" (2023) — DOI: 10.1109/sp46215.2023.10179310 — Facial recognition of a target person (67%) can be hidden while maintaining illegal content detection performance, triggered by a single photo that looks illegal.
• "Exploring Lawful Hacking as a Possible Answer to the "Going Dark" Debate" (2020) — DOI: 10.36645/mtlr.26.2.exploring — Lawful hacking is law enforcement accessing system contents using intrusion tools. One of the most frequently proposed alternatives and seemingly essential in a connected society, but the security and privacy risks of each regulatory approach must be understood.
• "A Comprehensive Overview of Government Hacking Worldwide" (2018) — DOI: 10.1109/access.2018.2871762 — The status of government hacking across five countries. Law enforcement asserts necessity while civil society worries about intrusiveness, weakened cryptographic standards, and internet safety risks.
• "Key extraction-based lawful access to encrypted data: Taxonomy and survey" (2024) — DOI: 10.1016/j.fsidi.2024.301796 — End-to-end encryption neutralized classical lawful access (seizure and wiretapping). Proposes a category extracting only keys to reduce the long-term, unlimited access risks of remote surveillance.
• "Crypto Crumple Zones: Enabling Limited Access without Mass Surveillance" (2018) — DOI: 10.1109/eurosp.2018.00028 — Limited access design imposing per-message computational costs without new third parties. Initial analysis shows $1,000 to $1,000,000 per message (excluding upfront costs), easily added to common cryptographic tools.
• "Reconciling Safety and Privacy: A Systematic Review of Moderation in End-to-End Encrypted Messaging" (2025) — DOI: 10.1109/isdfs65363.2025.11012061 — Deployed approaches mostly sacrifice some aspect of end-to-end encryption. User reports and metadata protect privacy but rely on participation, whereas on-device scanning harms privacy and is vulnerable to evasion. Evaluates new cryptographic techniques and points toward directions that do not weaken end-to-end encryption.
• "Going dark? Analysing the impact of end-to-end encryption on the outcome of Dutch criminal court cases" (2023) — DOI: 10.1186/s40163-023-00185-4 — In cases reaching court, Dutch courts appeared to secure convictions for defendants using end-to-end encryption at rates comparable to non-users. Impact at the investigative stage is inconclusive.
• "Encryption: A 21st Century National Security Dilemma" (1998) — DOI: 10.1080/13600869855487 — Argues that key recovery is difficult and expensive but a cost-effective compromise meeting law enforcement needs is required, following existing electronic surveillance laws allows balancing privacy and government interests, and urges hasty legislation before encryption becomes common.
• "Specifying a principle of cryptographic justice as a response to the problem of going dark" (2023) — DOI: 10.1007/s10676-023-09707-9 — The Five Eyes intelligence community has termed end-to-end encryption the "going dark problem" over the past decade, and several jurisdictions have passed laws restricting access.
• "Decrypting Australia's 'Anti-Encryption' legislation: The meaning and effect of the 'systemic weakness' limitation" (2022) — DOI: 10.1016/j.clsr.2022.105659 — The "systemic weakness" limitation in Australia's 2018 Assistance and Access Act blocks blatant front-line backdoors but is no panacea, likely losing effectiveness due to complexity.
• "Chat Control and the Repercussions of Mandatory Communication Detection" (2026, student law review) — DOI: 10.15168/tslr.v8i1.3967 — Criticism that the EU child sexual abuse material regulation proposal (moving from voluntary to mandatory detection) presumes reliable scanning technology while ignoring unresolved security vulnerabilities.
• "Towards arbitrating in a dispute - on responsible usage of client-side perceptual hashing against illegal content distribution" (2024) — DOI: 10.1145/3655693.3655712 — There is no consensus on the best response to child sexual abuse material. Organizes the discussion through competing hypothesis analysis without treating self-recommendations as the definitive answer.