In 1994, the United States Congress passed the Communications Assistance for Law Enforcement Act, requiring telecommunications carriers to design their networks with built-in capabilities for government wiretapping. The law emerged from FBI concerns that digital switching technology would render traditional surveillance impossible. CALEA’s solution was elegant in its naivety: force every carrier to build a standardized interface through which law enforcement could access communications pursuant to court order. The interface would be secure because it would be secret, protected by access controls, audited by compliance regimes. No adversary would find it because no adversary would know to look.
Twenty-two years later, the United Kingdom enacted the Investigatory Powers Act 2016, colloquially known as the Snooper’s Charter. It went further than CALEA, mandating that technology companies retain communications data and provide access mechanisms for intelligence agencies. The architecture was the same: centralized access points designed for authorized users, protected by the assumption that authorized users would be the only ones using them.
Salt Typhoon was the adversarial audit that the system failed.