Encryption's Shrinking Perimeter: Government Hacking and a Coin-Sized Aviation Threat

Cryptographer Matthew Green, a professor at Johns Hopkins, published a piece titled 'Everything Is About to Go Dark' that scored 356 with 159 comments on Hacker News. Green's argument is that the decades-long 'going dark' debate — law enforcement's contention that encryption is making lawful interception impossible — has entered a new phase. Rather than continuing to fight encryption legislatively, a battle largely lost since the 1990s Crypto Wars, law enforcement agencies are increasingly shifting toward endpoint compromise: hacking the device before the message is encrypted, rather than attempting to break the encryption in transit.

The legal terrain for this approach is significantly murkier than wiretapping under the Communications Assistance for Law Enforcement Act. Green's piece details how governments are exploiting device vulnerabilities and using commercial spyware to conduct surveillance, doing so under legal frameworks poorly suited to the new reality. A particularly sharp observation in his piece concerns the incentive structure this creates: when law enforcement relies on unpatched device vulnerabilities as an operational tool, it generates pressure — sometimes explicit, sometimes implicit — to stockpile zero-days rather than disclose them to manufacturers. The 2017 WannaCry ransomware attack, which used an NSA-developed exploit called EternalBlue after it was stolen and leaked, demonstrated that this is not a hypothetical risk.

That concern paired uncomfortably with a Wired report on a coin-sized device reportedly capable of interfacing with Boeing 737 avionics systems. The story drew 60 comments, including responses from commenters with avionics backgrounds drawing careful distinctions between accessing a data bus and actually issuing flight control commands — distinctions that matter enormously for assessing the actual threat level. Modern aircraft rely on multiple data buses, including ARINC 429 and ARINC 664, and regulatory standards including DO-326A and DO-356A are supposed to address isolation between avionics and passenger-accessible networks. The research raises legitimate questions about whether those standards have kept pace with increasingly IP-based avionics architectures. Both stories, read together, illuminate the same structural problem: a security perimeter — encrypted communications in one case, physical and network isolation in the other — that was assumed to be robust is proving more permeable than the model predicted.