Signal's formal statement rejects the UK Home Office's renewed push for compelled access to encrypted content, arguing that any mechanism to scan user content or weaken E2EE fundamentally breaks the security guarantee. The choice to publish as a signed, archival PDF rather than a blog post is itself a signal that this is a binding position of record — Signal will withdraw from the UK market rather than comply.
By submitting Signal's PDF to Hacker News, this user surfaced the statement to the developer community where it drew 468 points within hours. The strong upvote signal indicates the technical community broadly endorses Signal's framing that surveillance backdoors and real encryption are mutually exclusive.
The editorial points to 'Bugs in our Pockets,' the 2021 paper by 15 of the world's most-cited cryptographers — including Ross Anderson, Whitfield Diffie, Ron Rivest, and Bruce Schneier — which concluded on-device scanning creates surveillance infrastructure that cannot be limited to its stated purpose. Apple shelved its CSAM scanning plan the next year and the EU's CSAM regulation has been blocked four times on the same grounds, making the UK's renewed push a deliberate disregard of settled tech
The editorial highlights that the Investigatory Powers Act amendments now let the Home Office issue secret Technical Capability Notices requiring vendors to consult before shipping any change that would impede surveillance. Apple's 2024 withdrawal of Advanced Data Protection from UK iCloud already demonstrated the practical outcome — and Signal is now drawing the same line for messaging, framing TCNs as the operational mechanism that makes the UK uniquely hostile to secure-by-default products.
On June 8, Signal posted a PDF titled *Surveillance Is Not Safety* — a formal statement signed by president Meredith Whittaker rejecting the UK government's renewed push to compel encrypted messaging services to scan user content or weaken end-to-end encryption. The document is hosted at signal.org/blog/pdfs/2026-06-08-uk-surveillance-is-not-safety.pdf and hit 468 points on Hacker News within hours of publication.
The trigger is the latest round of UK Home Office signaling — building on the powers already on the books in the Online Safety Act and the Investigatory Powers Act amendments — that ministers want operational mechanisms for compelled access to encrypted content. Signal's statement reiterates a position the foundation has held publicly since 2023: there is no engineering compromise between end-to-end encryption and lawful intercept, and Signal will withdraw from any market that requires one. The PDF format itself is a choice — a signed, archival document rather than a blog post, framed as a statement of record.
The argument is not new. What's new is the timing. The UK's Technical Capability Notices regime now allows the Home Office to issue secret orders demanding pre-rollout consultation on any change that would impede surveillance — a structure Apple already protested in 2024 when it pulled Advanced Data Protection from UK iCloud users rather than comply. Signal is now drawing the same line on messaging.
The technical case against client-side scanning was settled in 2021. Fifteen of the world's most-cited cryptographers — including Ross Anderson, Whitfield Diffie, Ron Rivest, and Bruce Schneier — published "Bugs in our Pockets," concluding that on-device scanning creates a surveillance infrastructure that cannot be limited to its stated purpose. Apple shelved its CSAM scanning proposal the following year. The EU's CSAM regulation has been blocked four times by member-state opposition citing the same analysis. The UK is, in effect, the last large democracy still pushing the architecture.
The operational consequence for Signal is straightforward. The app's threat model assumes the server is hostile. Sealed sender, private contact discovery, and the Signal Protocol all exist to ensure that compromising Signal's infrastructure yields no message content and minimal metadata. A UK-mandated scanning client would invert that — making the *client* the surveillance surface, with the server (or any party with a TCN) gaining a privileged readout. There is no version of this that preserves the security property Signal currently sells. Whittaker's position — leave the market — is not bravado; it's the only response consistent with the product.
The community reaction on HN was unusually unified for a privacy thread. Top comments noted that the UK's framing has shifted from "think of the children" to a more general "online harms" rubric that lets the same scanning architecture be repurposed for terrorism, extremism, fraud, or whatever the next moral panic produces. Once the scanning pipeline exists on every phone, the question of *what* it scans for becomes a policy knob, not an engineering constraint. That's the load-bearing argument, and it's why cryptographers treat the debate as architectural rather than tactical.
The counter-position — articulated most clearly by the UK's National Crime Agency and groups like the IWF — is that the volume of CSAM circulating through E2EE channels is now measured in millions of images per year and that platform-level scanning is the only intervention that scales. This is empirically true. It is also true that any scanning system sophisticated enough to catch novel material is sophisticated enough to be weaponized, and any system narrow enough to be safe (hash-matching known material) catches a vanishingly small fraction of new abuse. The honest version of the debate is a values trade-off, not a technical one. The UK government's refusal to frame it that way is what makes Signal's statement necessary.
If you ship anything with end-to-end encryption — messaging, backups, secrets management, password sync, healthcare data — the UK's posture is now a concrete compliance variable, not a hypothetical. Three practical implications: first, your jurisdiction matrix needs a UK row that includes "may receive a Technical Capability Notice" as a risk. That notice is secret by statute; you cannot disclose it to users. If your architecture cannot satisfy a TCN without breaking your security claims, you need a documented withdrawal plan now, not when the notice arrives.
Second, the precedent matters even if you don't operate in the UK. Australia's TOLA Act, Canada's Online Harms Act, and the EU's stalled CSAM regulation all reference UK frameworks as templates. The architectural decision a startup makes today about whether E2EE is a hard constraint or a marketing claim determines whether your 2028 product survives the regulatory wave. Apple's iCloud retreat is the worked example: when ADP came off in the UK, it didn't come off cleanly — existing users had to actively disable it, and the company absorbed weeks of bad press for what was ultimately a forced move.
Third, if you build developer tools that touch user data — error tracking, session replay, observability, AI coding assistants that index repos — you're in the same conversation by extension. Scanning is scanning. A TCN that compels a messaging app to surveil its users is a precedent that compels a code-hosting platform to scan repos, an IDE vendor to instrument completions, or a CI provider to log secrets in clear. The line moves in one direction.
The near-term question is whether the UK actually issues a TCN against Signal, Meta (for WhatsApp), or Apple (for iMessage). If it does, the political calculation gets ugly fast — three of the most-used apps in the country going dark over the Home Office's signature would not be a quiet news cycle. The deeper question is whether "surveillance is not safety" remains a defensible slogan once a UK government can point to a specific harm prevented by a specific scan. Signal's bet is that the architectural argument outlasts any individual case. They're probably right. They're also out of the country either way.
From https://www.gov.uk/government/news/new-plans-to-stop-childre...:> Despite [iphone age verification] children can still take, view, share and save nude images. The government therefore wants Apple and Google to block nudity across the whole device by default, so they
So, in this order:1. You need a camera on your computer to allow a third party to verify your age before viewing adult content2. It applies to social media too3. It applies to your operating system too4. Unless you age verify, the law demands your computer must be powerful enough to run an AI, or be
Signal should come out swinging. Here's a pitch.The Government is going to put a snitch on every phone, tape every bedroom, and listen in every evening on every home. Every doctor's visit. Every therapy session. Every pub. Every street. Every store.When the snitches phone home, what you ty
Surveillance replaces ostensible individual fringe threats with a clear dangerous pervasive and (for practical purposes) irreversible threat that monotonically aggregates increasing centralized leverage over every aspect our lives, direct and indirect.Knowledge is power. Forced revelation of our inn
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.
I sometimes wonder whether the people in the tech industry who worked on things like secure boot, attestation, and DRM saw this as the inevitability open source advocates always saw it as.Did they think, as they worked to transfer final say from users to corporations, by technical means, that politi