Signal argues there is no technical mechanism that allows a 'trusted authority' to inspect end-to-end encrypted communications without creating an exploitable vulnerability. Inspecting plaintext on-device before encryption is, in their framing, the same thing as a backdoor regardless of how legislation labels it — a position grounded in decades of cryptographic consensus.
By submitting Signal's statement to Hacker News where it reached 517 points, this user amplified the position that surveillance mandates dressed up as safety measures are technically incoherent. The community's strong upvote response reflects broad agreement in the developer community that on-device scanning breaks the security model of E2E encryption.
The editorial highlights that Signal deliberately chose a numbered, structured PDF over a blog post — a format that reads like a legal filing meant for the record rather than social-media discourse. This medium choice is itself the message: Signal is preparing for a legislative and possibly legal fight, not a PR cycle.
The editorial frames this as the third round of an identical fight — 2022-2023 Online Safety Bill, the post-withdrawal pause, and now the revival under a new label. Even when each round is technically defeated, the proposal becomes more normalized, meaning regulators only need to win once while cryptographers must win every time.
On June 8, 2026, Signal published a formal statement — distributed as a PDF, not a blog post — titled *Surveillance Is Not Safety: A statement on the UK's latest threat to privacy*. The document, hosted at `signal.org/blog/pdfs/2026-06-08-uk-surveillance-is-not-safety.pdf`, hit the top of Hacker News with 517 points and became the dominant tech-policy story of the day.
The statement is Signal's response to the UK government's latest attempt to revive client-side scanning provisions under the Online Safety Act framework — proposals that would compel encrypted messaging providers to inspect message content on the user's device before it is encrypted and sent. Signal's position is unchanged from the 2023 fight, but the form has changed: this reads like a legal brief, not a blog post, complete with numbered claims and structured rebuttals. That choice of medium is itself the signal. Signal is not arguing on social media. It is putting a document on the record.
The core claims in the statement are the ones the cryptography community has been making since the late 1990s: there is no technical mechanism that lets a 'trusted authority' read end-to-end encrypted messages without also creating a vulnerability that any sufficiently motivated adversary can exploit. Client-side scanning — inspecting plaintext on-device before encryption — is mathematically equivalent to a backdoor, regardless of how the legislative text frames it.
This is the third round of the same fight. The UK first floated mandated scanning under the Online Safety Bill in 2022-2023, walked it back after Signal, WhatsApp, and Apple all publicly threatened to withdraw, and is now reintroducing the substance under a new label. The pattern is becoming a regulatory ratchet: each round normalizes the proposal a little more, even when each round is technically defeated.
The asymmetry here favors the regulators, not the cryptographers — Signal can win the argument every time and still lose the war if it has to keep showing up. That is part of why this statement is structured the way it is. A PDF on signal.org with formal numbered sections is citable in parliamentary testimony. A Twitter thread is not. Meredith Whittaker and Signal's legal team appear to be building a paper trail for future regulatory and judicial proceedings, not winning a single news cycle.
The technical community's response on HN was unusually unified. The top-voted comments did not relitigate whether client-side scanning is a backdoor (a debate that exhausted itself two years ago) — they focused on the *political economy* of the proposal. Why does this keep coming back? The answer most commenters converged on: because the political cost of proposing it is low and the political reward of being seen to 'do something about online harms' is high. The cryptographers have to win every round. The Home Office only has to win once.
There is also a more uncomfortable read of the situation. WhatsApp and iMessage have hundreds of millions of UK users. Signal has comparatively few. If the UK passes a law that forces Signal out but lets WhatsApp negotiate a compromise, the practical result is an encryption ecosystem where the rigorous option dies and the convenient option survives in a degraded form. That is the outcome the statement is implicitly trying to prevent — by making it politically expensive for any competitor to cut a separate deal.
It is worth being precise about what Signal is and isn't saying. Signal is not arguing that CSAM, terrorism, or fraud are not real problems. The statement explicitly acknowledges they are. The argument is narrower and harder to dismiss: the specific technical mechanism being proposed does not solve those problems and creates new ones. Bad actors move to other tools (there are dozens). Everyone else gets surveilled. The harms the law claims to address are not reduced; the surface area for abuse is increased.
If you ship a product that handles user messages, files, or any private communication, the UK proposal — if it passes in anything like its current form — is not abstract policy. It is a compliance problem with engineering implications.
First, the legal exposure model changes. Under client-side scanning mandates, the provider becomes responsible for the content of messages they cannot, by design, read — a contradiction that resolves itself by forcing the provider to break the design. Any team currently building on Matrix, MLS, or rolling their own E2EE should be reading this statement carefully, because the regulatory framework being proposed treats 'we can't decrypt it' as a non-defense.
Second, the architectural implications cascade. If you have UK users and you implement client-side scanning, you have effectively added a second cryptographic key holder (the scanning model and whoever controls its update channel) to every conversation. That is a supply-chain attack surface. The model weights, the hash database, the update mechanism — all of these become high-value targets. Apple's 2021 CSAM-scanning proposal foundered on exactly this point: researchers demonstrated within weeks that the perceptual hash function was reversible and collidable.
Third, the jurisdictional question gets ugly fast. If your service is incorporated outside the UK but has UK users, you face the same choice Signal is laying out: comply, geofence, or withdraw. Geofencing E2EE products by IP is trivial to circumvent and creates a worse user experience for legitimate users, which is why Signal's stated answer has historically been 'we leave.' Small providers without Signal's brand equity may not have that option.
For security-team folks: this is a good moment to inventory which of your vendors operate E2EE products and what their stated UK posture is. If you have a UK office and you rely on Signal-the-product for sensitive internal comms — many security teams do — there is a non-zero probability that channel becomes unavailable in your jurisdiction within 18 months.
The most likely outcome, based on the 2023 precedent, is another partial retreat: the language gets softened, the implementation timeline gets pushed, and the proposal is reintroduced in a slightly different form in 2027 or 2028. The Signal statement is not really arguing against the current bill — it is trying to raise the political cost of the entire category of legislation, so that the next round is harder to mount than the last one. That is a long game, and Signal is one of the few organizations with the funding, brand, and engineering credibility to play it. The interesting question is which other providers — WhatsApp, Apple, Matrix — sign on to the same posture publicly, and which ones go quiet and start negotiating.
From https://www.gov.uk/government/news/new-plans-to-stop-childre...:> Despite [iphone age verification] children can still take, view, share and save nude images. The government therefore wants Apple and Google to block nudity across the whole device by default, so they
So, in this order:1. You need a camera on your computer to allow a third party to verify your age before viewing adult content2. It applies to social media too3. It applies to your operating system too4. Unless you age verify, the law demands your computer must be powerful enough to run an AI, or be
Signal should come out swinging. Here's a pitch.The Government is going to put a snitch on every phone, tape every bedroom, and listen in every evening on every home. Every doctor's visit. Every therapy session. Every pub. Every street. Every store.When the snitches phone home, what you ty
Surveillance replaces ostensible individual fringe threats with a clear dangerous pervasive and (for practical purposes) irreversible threat that monotonically aggregates increasing centralized leverage over every aspect our lives, direct and indirect.Knowledge is power. Forced revelation of our inn
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.
I sometimes wonder whether the people in the tech industry who worked on things like secure boot, attestation, and DRM saw this as the inevitability open source advocates always saw it as.Did they think, as they worked to transfer final say from users to corporations, by technical means, that politi