A traveler powers on a laptop at a border checkpoint, complies with a routine request from a customs agent, and walks away minutes later carrying something unwanted: software capable of reading the screen, copying files, and running commands without consent. This is not a hypothetical. Germany's so-called Bundestrojaner, or "state trojan," was exposed by the Chaos Computer Club in 2011, and its existence points to a deeper contradiction that author and digital rights activist Cory Doctorow laid out in his October 13 newsletter - governments claim to defend citizens' digital security while actively undermining it.
The tension is structural, not accidental. Agencies tasked with protecting networks also want the ability to break into them, and since they cannot always predict who their adversaries will be, intelligence services have long pushed for backdoors that only "trusted" parties can use. Doctorow calls this an irreconcilable conflict of interest, and the record supports him: software built with a deliberate weakness for one actor becomes a weakness for everyone. It's part of why privacy-conscious users increasingly look toward tools they can inspect themselves - choosing, for instance, a VPN with open-source clients rather than closed systems whose inner workings can't be verified by independent researchers.
A Four-Decade Pattern of Self-Inflicted Harm
The conflict traces back to the 1990s "Crypto Wars," when the NSA classified strong encryption as a munition and restricted civilian access to it. The Electronic Frontier Foundation, led at the time by a young lawyer named Cindy Cohn, won the Bernstein case, establishing that code is protected speech under the First Amendment. Cohn's memoir, Privacy's Defender, revisits that fight in detail. But rather than abandoning the project of weakening public security, intelligence agencies adopted a doctrine called NOBUS - "no one but us" - hoarding software vulnerabilities instead of reporting them so they could be fixed. The assumption was that only American intelligence possessed the sophistication to find these flaws.
That assumption proved false. Research cited by Doctorow suggests that rival states and criminal groups independently rediscover hoarded vulnerabilities at a steady pace year after year. When the NSA's own cache leaked in 2017, the Windows flaw known as EternalBlue became the engine behind WannaCry, a ransomware outbreak that disabled hospitals, banks, oil infrastructure, Baltimore's municipal government, and the British Library. The Bundestrojaner followed the same arc: built for covert state use, it was insecure enough that anyone scanning the internet could locate and hijack infected machines, handing the same access to criminals and foreign spies that German authorities had reserved for themselves.
Surveillance Mandates Dressed as Safety Measures
The pattern persists in newer policy debates. The European Union's "chat control" proposal would require continuous scanning of personal devices for illegal material, a system that has already misfired - a parent lost access to his entire digital life after an automated scanner misidentified a medical photograph. Age verification laws spreading across jurisdictions raise a similar problem: there is no way to confirm a user's age without building a database of sensitive identity documents, and such databases are magnets for breaches. A 2026 incident involving Discord, which exposed tens of thousands of user records, is one recent illustration.
Commercial Spyware and the Absence of Consequences
Governments also buy offensive tools from private cyber-arms firms, largely based in Israel and the United Arab Emirates, with additional players in Italy and the United Kingdom. These companies find or purchase vulnerabilities, weaponize them, and sell access to governments, corporations, and sometimes criminals - a practice researchers at Citizen Lab have tracked closely. Doctorow argues that a government genuinely committed to public safety would prosecute these firms rather than let their founders become billionaires. Copyright law adds another obstacle: anti-circumvention provisions have discouraged researchers from disclosing dangerous flaws, as happened when Sony-BMG's rootkit-infected CDs went unreported for months in the mid-2000s.
The rise of autonomous hacking tools making headlines now did not emerge from nowhere. They exploit infrastructure that governments have spent decades deliberately weakening in the name of investigative access. Fixing that will require rewarding vulnerability disclosure, penalizing hoarding, and abandoning mandates that trade security for surveillance convenience - not simply assigning liability after the next breach.
