Exploitable security holes
SPLIT
Mandated backdoors and client-side scanning risks are documented technically.
Intent by US actors to exploit those holes remains unproven.
- Scope & Thesis Research file / Tier 1
Technology pillar
Backdoor Precedent
Historical examples are used here for one narrow lesson: access mandates and exceptional-access architectures create exploitable attack surfaces. They are not used as evidence that Thorn, Chat Control, or a US-government actor directs the EU file. FACT INFERENCE
The lesson, not a motive story
The technical explainer shows where client-side inspection enters a private-communications flow. This article answers the next question: whether mandated access has a historical risk record. The answer is yes, but the claim stops there. FACT
The comparative cases below support the proven technical half of the lawful-access risk: exceptional access is an attack surface. They do not become evidence about Thorn, Safer, NCMEC, European Commission DG HOME, or hidden US direction of Chat Control. INFERENCE
Proof Boundary
The scorecard keeps exploitability separate from intent and keeps industrial espionage speculative.
Industrial/economic espionage
SPECULATIVE
No evidence Thorn or Chat Control is a vehicle for US industrial espionage.
Retain only as a weak hypothesis and do not promote Tier 3 comparisons into proof.
- Scope & Thesis Research file / Tier 1
- Debunked / Corrected Claims Ledger Ledger / Tier 1
Evidence-Graded Examples
These cards present context for non-specialist readers while keeping the source tier and evidence grade visible.
PROVEN FACT
Client-side scanning is expandable by design
Abelson et al. document the core architecture problem: once scanning is placed on the client, policy and configuration can change what the system looks for.
This is the technical half of the lawful-access risk claim. It does not prove motive.
- Technical & Legal Case Against Client-Side Scanning Research file / Tier 1
- Scope & Thesis Research file / Tier 1
PROVEN FACT
A lawful-intercept channel became an attack surface
The Salt Typhoon record is used here as historical context for the narrow lesson that exceptional-access infrastructure can be exploited by an adversary.
Tier 3 comparative material; not evidence about Thorn, Chat Control, or US-government direction.
- Surveillance Systemic Risk Research file / Tier 3
- Scope & Thesis Research file / Tier 1
PROVEN FACT
Vodafone Greece's intercept subsystem was abused
The Athens Affair illustrates the same engineering warning: an access mechanism built for authorized interception can be repurposed by an unauthorized actor.
Used only to explain exploitability, not to infer who directs the EU file.
- Surveillance Systemic Risk Research file / Tier 3
- Scope & Thesis Research file / Tier 1
SPLIT INFERENCE
Exploitability is proven; intent remains unproven
The dossier's claim is deliberately narrow: mandated access and exceptional-access architectures create exploitable attack surfaces.
The article does not claim that US actors intend to exploit those holes.
- Technical & Legal Case Against Client-Side Scanning Research file / Tier 1
- Surveillance Systemic Risk Research file / Tier 3
- Scope & Thesis Research file / Tier 1
Why CALEA and Salt Typhoon belong here
The CALEA/Salt Typhoon example is not a claim about Europe and not a claim about Thorn. It is a concrete precedent for the engineering warning: infrastructure created so approved parties can reach communications can later become a route for an adversary. FACT
Why the Athens Affair belongs here
The Athens Affair gives non-specialist readers the same lesson in another setting. A lawful intercept subsystem existed; it was abused; the victim set included senior political targets. The policy conclusion is bounded: exceptional-access systems need to be judged as attack surfaces, not only as compliance tools. FACT
How this connects to client-side scanning
Client-side scanning is not identical to telecom intercept equipment, but it shares the security problem that matters here: a mandated access path creates a durable control point. Once the control point exists, later fights are about who controls lists, thresholds, updates, review pathways, and legal expansion. INFERENCE
What stays out
ECHELON-era economic-spying material is not part of this article's affirmative argument. The rejected Airbus/Boeing hand-off claim belongs in the methods ledger, not in a proof chain about Chat Control. The article also does not infer covert direction from comparative cases. The supported warning is enough: mandated access can be exploited.
SPECULATIVE
Ledger route for rejected economic-spying claims
No evidence Thorn or Chat Control is a vehicle for US industrial espionage.
ECHELON context may explain why overclaiming is tempting, but the direct Airbus/Boeing hand-off claim remains unproven and excluded from this article's proof chain.
- Debunked / Corrected Claims Ledger Ledger / Tier 1
- Surveillance Systemic Risk Research file / Tier 3
- Scope & Thesis Research file / Tier 1
UNPROVEN INFERENCE
No covert-direction inference
Comparative backdoor failures do not identify who shaped the CSA Regulation, do not prove US-government direction, and do not show that a child-safety vendor intends exploitation.
- Scope & Thesis Research file / Tier 1
- Technical & Legal Case Against Client-Side Scanning Research file / Tier 1