Wired's Kernel Panic column argues this week that encryption is not being abolished but compressed — and that the pressure is arriving from several directions at once.
That framing matters because the encryption debate spent three decades as a binary. Either a product had end-to-end encryption or it did not; governments argued for exceptional access, engineers replied that an exception for the good guys is a vulnerability for everyone. What has changed is that the fight has been decomposed into many smaller, individually reasonable demands, each aimed at a different layer of the stack.
Start with lawful access. The demand for exceptional access has not gone away; it has been proceduralised — technical capability notices, mutual legal assistance arrangements and draft rules that oblige providers to be able to act on a warrant they cannot technically satisfy without having built the backdoor first.
Then the edge. Content scanning pushed from servers onto devices turns the endpoint into the inspection point: on-device matching for illegal material, age assurance that requires an estimate of who you are before anything renders, fraud detection that reads message metadata. Every measure has a defensible rationale. Together they normalise the idea that a device should be able to look at what it is encrypting.
Third, the commercial layer. AI systems want data, and the cleanest guarantee that data is never used for training is that it is never readable. The deeper models reach into messaging, mail and enterprise documents, the stronger the incentive to relax that guarantee — even locally, even briefly.
Fourth, the hardware. Confidential computing, remote attestation and secure enclaves move trust from mathematics to vendors. That is a genuine improvement on trusting an operating system and a genuine regression from trusting a key you hold yourself: whoever controls attestation controls the boundary.
The honest counterpoint is that encryption is not losing. Messaging interoperability is being built on MLS, passkeys are replacing passwords at scale, and end-to-end encrypted backups have gone from exotic to normal. The risk is not collapse but fracture: a patchwork in which the same product is strongly encrypted in one jurisdiction, weakly encrypted in another and scanned on-device in a third — with providers choosing the weakest common denominator for cost reasons.
Which is why the column's metaphor holds. Compression does not break anything visibly. It changes what is possible at the edges until a guarantee that used to be absolute becomes conditional, and then becomes a feature tier. The measures that do this are almost never called encryption policy; they are called child safety, age verification, fraud prevention and competition.
What to watch: the EU negotiations on the child sexual abuse regulation and whether detection orders survive in any form; the litigation over UK technical capability notices, including Apple's challenge to an iCloud backdoor demand; how age-assurance regimes land at platform versus device level; and whether any regulator formally tests the claim that client-side scanning can be both targeted and non-generic. The test is not whether encryption survives — it will. The test is whether the word still means the same thing in five years.
