A backdoor is a deliberate hidden mechanism in a system that allows access bypassing normal authentication or encryption. Distinguished from a vulnerability (an unintended weakness that an attacker discovered) by intent: backdoors are placed there on purpose by the system’s designers, by the supply chain, or by a government compelling the manufacturer. The category is the central object of the encryption-policy debate in the US, UK, EU, and Australia.
What it means in practice
The structural problem with backdoors is that they cannot be selectively used. A backdoor for “lawful access” is a backdoor for any sufficiently motivated adversary who finds it: criminal hackers, foreign intelligence services, malicious insiders, abusive partners, or future political regimes that the original drafters did not anticipate. The 2015 Apple-FBI dispute (the San Bernardino phone) crystallized the public version of this argument. The 2025 UK Technical Capability Notice forcing Apple to remove Advanced Data Protection for UK users is the operational version: a government secured backdoor-equivalent access by compelling the architecture change rather than the cryptographic break. The trend continues: Australia’s Telecommunications and Other Legislation Amendment (Assistance and Access) Act 2018, the EU’s “going dark” debates, the US EARN IT Act variations.
Where it shows up
Documented cases of intentional backdoors: the Dual_EC_DRBG cryptographic backdoor (NSA-influenced, exposed in Snowden documents), the Juniper ScreenOS backdoor (2015, attributed to nation-state attackers exploiting a prior vendor-side modification), various router firmware backdoors in consumer hardware. Documented cases of compelled backdoor-equivalents: the UK’s 2025 Apple ADP removal, the Australian TOLA Act provisions used in undisclosed counts of cases, the EU’s mandatory client-side scanning proposals (2022-2026, repeatedly proposed and repeatedly delayed). The threat tier where backdoors matter most: any operator whose threat model includes both criminal and state adversaries, because any backdoor accessible to the state is structurally accessible to whoever else finds the same path.
What you can change today
The structural defenses against backdoors. Choose products whose source code is open and auditable (Signal, Wire, GrapheneOS, GPG, OpenSSH, all WireGuard implementations). Choose providers in jurisdictions that have not (yet) compelled backdoor architectures in the way the UK has (Switzerland for Proton, Iceland for some specialty providers, Germany for Tutanota and Mailbox.org). For the highest tier: assume any cryptographic system with a “lawful access” provision in any jurisdiction has a backdoor in that jurisdiction, and route around it. The cryptographic primitives themselves remain mathematically sound; the architectural choices around them are where compromise lives.