There’s a saying among early adopters of Zero Trust security practices: “Assume breach.” In this paradigm, you operate as if that the bad guys aren’t just knocking at the door — they’re already inside the house.
Unfortunately, as shown by recent breach notifications, this is the case for U.S. telecom providers. And now, with the U.S. presidential election a week away, Chinese state-affiliated hackers have accessed U.S. political communications through telecom networks, highlighting a fundamental paradox in our approach to privacy and security: systems designed to enable authorized surveillance often create vulnerabilities that can be exploited by unauthorized actors.
Just a few weeks ago we learned that China had infiltrated Verizon, AT&T, and Lumen’s wiretapping systems, which was a disturbing development on its own. Now, with the Washington Post's report of Chinese hackers intercepting calls and messages from both Trump and Harris campaign affiliates, this isn't just another cyber incident; it highlights why layered security is essential to close the gaps created by backdoors and dissolving perimeters.
CALEA: A Case Study in Unintended Consequences
The Communications Assistance for Law Enforcement Act (CALEA) mandates that telecommunications providers build wiretapping capabilities into their infrastructure. This law, while well-intentioned, exemplifies the privacy paradox. While it aims to enable legitimate law enforcement investigations and standardize surveillance capabilities for the digital age, it simultaneously creates the possibility that bad actors could exploit the same backdoor – turning something that was designed for legal law enforcement, into something that is being used by adversaries, as we saw recently with the hack targeting wiretap systems at Verizon and AT&T.
The recent breach reveal cascading privacy implications that extend far beyond individual communications. Personal conversations may be vulnerable not just to domestic surveillance but to foreign intelligence services, effectively eliminating the distinction between "private" and "accessible" communications.
While it is not yet known whether the latest hacks on U.S. election campaigns are connected with unauthorized backdoor access, the political ramifications are particularly concerning. Campaign communications, crucial for democratic processes, are now demonstrably vulnerable to interception. Strategic discussions and sensitive political deliberations could be compromised, potentially affecting the integrity of our election. The commercial sector faces similar challenges, with business communications, intellectual property, client confidentiality, and even U.S. critical infrastructure all at risk through standard telecommunications channels.
Beyond the False Choice
We're often presented with a false dichotomy: either accept backdoors for law enforcement or enable criminals to communicate with impunity. This framing fundamentally misunderstands the nature of security and privacy in digital systems. Backdoors make everyone less secure, including law enforcement themselves. Strong encryption and privacy protections benefit legitimate users far more than bad actors, and alternative investigative methods often exist that don't require compromising system security.
A New Approach to Privacy and Security
Instead of mandating backdoors, we need a fundamental shift in how we approach communications security. Technical solutions should prioritize data-centric concepts, like end-to-end encryption and granular access controls by default and implement Zero Trust systems that don't require relying on service providers. Our communications infrastructure should be designed with privacy at the center — and that means putting layered protections in place to safeguard what’s most important, the data itself.
Moving Forward
While the full story and methodology behind the Chinese hacking of U.S. election communications is yet to be determined, this case demonstrates why Zero Trust is a powerful — and necessary — framework. When the bad guys are already in our midst, we should ensure that layers of security, like granular access controls and object-level encryption, are in place to safeguard our most important data from their reach. Furthermore, we must remember and consider that when we build backdoors into our systems, we may not be able to control who walks through them.
The implications extend far beyond this single incident, calling into question our entire approach to balancing security and surveillance. Strong privacy protections are not obstacles to security—they are essential components of it.
The question isn't whether law enforcement should have investigative tools, but whether those tools should come at the cost of making everyone's communications vulnerable. When it comes to backdoors, we have a clear answer: the price is far higher than we can afford to pay. As we move forward, we must recognize that true security requires strong privacy protections, not mandated vulnerabilities.
