Green argues that end-to-end encryption and full-disk encryption effectively won the crypto wars, so law enforcement and intelligence agencies pivoted from demanding keys to purchasing exploit chains from vendors like NSO Group, Intellexa, Candiru, and Cognyte. The wiretap didn't disappear — it became a procurement line item, turning a shady vendor ecosystem into first-class state capacity used against everyone from cartel figures to journalists.
Green forecasts that memory-safe languages, sandboxing, and hardware mitigations will progressively grind down the exploitable attack surface, eventually capping the number of useful bugs available to buy. In his view, the current era of law enforcement hacking is a transitional plateau, not a permanent equilibrium.
Pushes back on Green's optimism about a bug ceiling by pointing to the current direction of software development: companies are shipping more sloppily written, AI-assisted features, not fewer. From that vantage point, the attack surface is expanding, not contracting, and exploit vendors will have no shortage of raw material.
Argues that with cameras on every doorbell, stoplight, and pocket, plus metadata trails from every device, the notion that investigators had 'gone dark' was theater from the start. Encrypted messaging apps were never the whole picture — the surrounding sensor grid always kept targets highly visible.
Rejects the framing that constrained state hacking capability is a bad outcome, sarcastically asking why anyone should be concerned that the US government and Israel might lose the ability to hack everyone's phones. The implicit position: these actors have abused the capability enough that its erosion is a feature, not a bug.
Matthew Green — Johns Hopkins cryptographer, longtime narrator of the crypto wars — used his post-Usenix Security dispatch to spell out what most of that conference talks around: the FBI's decade-old "going dark" complaint has quietly been solved, just not the way anyone in Washington wanted to admit. Signal, iMessage, WhatsApp, and full-disk encryption on modern phones are, for practical purposes, unbreakable in bulk. So law enforcement and intelligence agencies stopped asking for keys and started buying exploits.
Green's piece, written from Baltimore this week, walks through the mechanics: a small industry of vendors — NSO Group, Intellexa, Candiru, Cognyte, plus quieter US and allied contractors — sells chains of zero-day vulnerabilities to governments. Those chains are then burned on targets ranging from cartel lieutenants to journalists to opposition politicians. The wiretap didn't disappear; it got outsourced to a supply chain of bugs, and that supply chain is now a first-class piece of state capacity.
The Hacker News thread mostly agrees with the framing but splits on the forecast. Green argues we may eventually hit a ceiling on the number of useful bugs as memory-safe languages, sandboxing, and hardware mitigations grind down the attack surface. Commenter `mbroshi` pushes back bluntly: "I see companies adding more sloppily written features with AI. I see more bugs in the software I use, not less." `fitblipper` points at the other flank — with cameras on every doorbell, stoplight, and pocket, the "going dark" label was always theater. `Gigachad`, less politely: "I'm supposed to be concerned that the US government and Israel won't be able to hack everyone's phones?"
The conventional story of the last fifteen years is that cryptographers won. Snowden, the iPhone-vs-FBI standoff over the San Bernardino device, the WhatsApp rollout of the Signal protocol — each looks like a defeat for the surveillance state. Green's contribution is to point out that the scoreboard was wrong. Governments never actually lost access; they just moved the budget line from "legal process" to "vulnerability research," and that line item has grown into a multi-billion-dollar global market.
That matters for three reasons. First, it inverts the incentives around software quality. When wiretaps required a court order and a phone-company cable, bugs in consumer software were somebody else's problem — probably Microsoft's. Now every unpatched use-after-free in WebKit or the Android media stack is a potential procurement item for a foreign ministry. The economic value of a reliable iOS zero-click has been reported north of $2 million; the same bug patched on Tuesday is worth zero on Wednesday, which is why the brokers pay for silence, not disclosure.
Second, the model doesn't scale the way mass surveillance did. Bulk collection under FISA 702 or the old Section 215 metadata program touched hundreds of millions of records for pennies each. An NSO chain against a single iPhone can cost six or seven figures and burns when Apple ships a point release. That is a genuine constraint — Green is right that this pushes agencies toward high-value targets rather than dragnets — but it is also why they need a steady pipeline of new bugs. A world in which iOS, Android, and Chrome all shipped Rust rewrites tomorrow would be a world in which the CIA's Special Collection Service has a serious capacity problem within 18 months.
Third, it turns every domestic security decision into a foreign-policy one. When CISA pushes memory safety, or when Apple ships Lockdown Mode, they are not just protecting American grandmothers from ransomware; they are directly degrading the operational capability of the DGSE, the MSS, and Unit 8200 — and, awkwardly, of the FBI's own Remote Operations Unit. The reason Washington has never issued a coherent policy on commercial spyware is that its own agencies are customers of the same vendors it periodically sanctions.
Green's ceiling argument is the interesting technical bet. Modern iOS has BlastDoor, Pointer Authentication, kalloc_type isolation, and increasing swaths of Swift. Chrome's V8 sandbox and MiraclePtr have measurably raised the cost of renderer exploitation. Android is inching toward a Rust-heavy media stack. If you believe hardware-enforced isolation and memory-safe rewrites compound, the exploit market gets structurally more expensive every year. `mbroshi`'s counter — that AI-generated code is pumping fresh bugs into the ecosystem faster than mitigations remove them — is the strongest version of the pessimist case, and it's not obviously wrong. The honest answer is that nobody has real numbers yet on whether Copilot-era codebases are net more or less exploitable.
If you ship software that touches human beings — messaging, healthcare, journalism tools, anything used by activists or lawyers — the threat model has changed and you probably haven't updated the doc. "Nation-state adversary" is no longer a hand-wave; it is a specific vendor with a specific price sheet and a specific set of exploitation primitives, and there is a non-trivial chance one of your users is on that price sheet. Concrete moves worth taking this quarter:
- Audit your update pipeline like it's a security control, because it is. The delta between a bug being reported and 95% of your users being patched is the window every commercial spyware vendor lives in. If your desktop app or embedded firmware still ships "click to update," that's the loudest smell in your stack. - Push memory-safe rewrites where the attack surface is thinnest — parsers, network stacks, media pipelines. You don't need to rewrite the world. You need to rewrite the code that touches attacker-controlled bytes first. Cloudflare's Pingora, Google's Rust Android media components, and Microsoft's Rust-in-Windows work are the reference paths. - Turn on and default the platform hardening you already paid for. Lockdown Mode on iOS, MTE on Pixel 8+, Chrome's site isolation, WebAssembly sandboxing for plugin systems. Most of these ship off by default because they break something. Break the something. - Rethink your bug bounty economics. If a working exploit in your product is worth $500k on the gray market and $15k on your HackerOne, you are not competing for the researcher's attention — you are subsidizing the other buyer's discount. The serious programs (Apple, Google, Meta) have moved bounties into six figures for a reason.
For infra and platform teams the implication is subtler: your job now includes reasoning about which of your dependencies are attractive targets for state buyers, not just for opportunistic ransomware crews. A memory-corruption bug in a niche VPN client used by three governments is a very different asset than one in an enterprise CRM.
Green is deliberately hedged on the timeline, and he should be. The exploit market could plateau in five years as memory safety compounds, or it could balloon as AI both writes more vulnerable code and finds more vulnerabilities in existing code — probably both, unevenly. What is no longer in dispute is that the political question "should the government be able to read encrypted messages" was settled by procurement, not by legislation. The next fight is over whether the same governments will regulate — or protect — the vendors they buy from. Don't hold your breath, but do turn on auto-update.
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.