Encryption: the other routes to evidence

The economic cost of a backdoor · Part 6 of 7

A legal demand may produce a handful of dates. An operation across a network may feed cases in several countries. Between those outcomes lie forensic tools, skilled investigators and the work of building a verifiable case. Evidence from France, the United States and China reveals what these routes can deliver, the resources they consume and the risks others may bear.

On 3 November 2026, Signal published an account of a US legal demand. A grand jury subpoena dated 5 October sought information about four phone numbers. According to the messaging service, three had no corresponding account. For the fourth, its response the following day supplied the account’s creation date and time, along with the date it had last connected to Signal’s servers. The service said it did not retain the time of that last connection. ^W02

The response amounted to a few pieces of metadata: information about an account’s existence and activity, distinct from the content of its conversations. Signal’s account is accompanied by redacted court documents confirming the scope of the request and response. The case gives the debate a concrete starting point. The response depends on the information the company says it retains and the form in which that information exists. ^W02

Investigators have to work with this distribution of information. They can seek records from a provider, examine a device, connect separate clues or draw on an operation targeting a particular service. Each route has its possibilities and constraints. An economic comparison begins with what each can deliver: which additional evidence becomes available, with what resources, on what timetable, and with what exposure for other users? ^W21

Method and scope

Documented case: request dated 5 October 2026, response dated 6 October, provider account published on 3 November. Signal’s account and the redacted court documents establish this scope: four numbers, rather than four established individuals; three without a matching account; for the matching account, creation date and time, then the date of last contact without its time. The diagram identifies only their nature, without personal values. A search without a matching account describes that particular lookup. The investigation’s outcome remains unknown.

Several places to look for the same information

End-to-end encryption protects the content of a conversation between its endpoints. Investigators can therefore look for information surrounding that conversation, or on the devices used to read it. A 2018 report by the US National Academies distinguishes several such routes, including metadata, data available in cloud services and access to devices. They can complement one another, with availability depending on the systems involved. ^W21

A readable backup held by a provider may contain a piece of evidence investigators need. An encrypted backup whose key is unavailable to the provider presents a different situation. Likewise, a connection record may help establish when an activity took place, while the content of a message may supply a detail that nothing else can replace. The value of a source depends on the question it can answer. The report also stresses the resources and expertise required to make use of these opportunities. ^W21

These complementarities shape the economics of an investigation. One lead can direct a search that makes another piece of information useful. On this reasoning, funding analysis can increase the value of access already secured; buying another tool may achieve little if nobody can validate its output. This dependence between stages is central to Europol’s assessment of digital investigation needs, published on 16 October 2026. ^W18

Encryption remains a measurable obstacle

US statistics reveal the obstacle, provided their denominator stays in view. For 2025, the Administrative Office of the US Courts recorded 296 reported federal wiretap authorizations involving encryption, and 229 at state level. Authorities reported that encryption had prevented them from obtaining the readable content, or plaintext, for 269 and 217 of them respectively. Together, that is 486 out of 525: 92.6%, rounded. The Congressional Research Service reproduces these figures in a version of its briefing dated 29 October 2026 and archived by EveryCRSReport. ^{W01 W06}

The finding gives weight to the operational problem. Within this subset, the reported obstacle was frequent. Its scope is specific: the units are reported authorizations associated with reports of encryption, and the data concern wiretaps concluded in 2025. The federal form asks about encryption encountered during the investigation; the non-federal guidance consulted uses narrower wording, referring to intercepted communications. Those differences in collection need to accompany any reading of the total. ^W01

The ratio leaves the outcome of the underlying cases unresolved. Investigators may have obtained other evidence; they may have lost something essential. The report leaves both possibilities open. Coverage is also affected by missing or late submissions, and excludes interceptions under the Foreign Intelligence Surveillance Act, or FISA. The plaintext failure share measures an access problem within this scope. Estimating how many additional cases could be solved would require following their progress and the other evidence available. ^W01

EncroChat, ANOM and the San Bernardino iPhone

EncroChat illustrates another route. In 2020, a joint French and Dutch investigation team, supported by Eurojust and Europol, worked on the encrypted communications service. In its assessment published on 27 June 2023, Eurojust reported 6,558 arrests worldwide. This is an outcome reported by the authorities as of that publication. Its date matters when the same figures appear on a subsequently updated page. ^W11

The operation shows what access to a particular environment can contribute to investigations. It also helps clarify the word “targeted”: a specified service can have many users. The technical scope of an operation and the number of people affected warrant separate scrutiny. The published official results provide an observation; the operation’s full cost and its reproducibility on other messaging services remain to be established. ^{W11 W21}

ANOM followed a different model in the United States. The US Federal Bureau of Investigation (FBI) secretly ran the network. On 7 February 2025, federal prosecutors in San Diego announced that all eight defendants extradited by that date, out of seventeen indicted in 2021, had pleaded guilty to racketeering conspiracy. The release described a network for which more than 12,000 devices had been distributed in 100 countries. An operation on a particular service can thus produce court outcomes while reaching a substantial number of users. These results are reported by the prosecution; the return on a general policy remains an open question. ^W04

Access to a device offers another lesson. In the San Bernardino case, the US government told the court on 28 March 2016 that it had accessed the seized iPhone with help from a third party. The Justice Department’s inspector general subsequently found that shortcomings in communication and coordination had delayed the involvement of relevant resources and that provider. It found no evidence that the capability was already available when the FBI made its initial statements, which it therefore did not find inaccurate at the time. ^W03

This case documents room for organizational improvement in a specific investigation. Getting a request to the right team can change what an institution is able to obtain. The finding remains tied to that phone, that period and the inspector general’s evidence. Access capabilities evolve with devices and software; these examples leave their universal availability unproven. ^{W03 W21}

Shortening the legal route

Data may be technically available but held by a provider subject to another jurisdiction’s laws. The pace of an investigation then also depends on the route through which a request travels. This is one purpose of the European Union’s e-evidence framework, whose regulation has generally applied since 18 August 2026. It provides for orders concerning stored data held by a provider, or on its behalf, when the order is received. ^W13

The timetable has several branches. Where notification to the enforcing authority is unnecessary, the recipient must transmit the data within ten days of receiving the European Production Order Certificate, or EPOC. Where notification is required, the data must be preserved promptly; transmission follows at the end of the ten-day period if no ground for refusal has been raised, or as soon as possible after an earlier express confirmation that none will be raised. For emergencies defined by the regulation, the transmission deadline is eight hours from receipt of the certificate. In an emergency, the notified authority has up to 96 hours from receipt of the notification to object to the use of the data or specify conditions for their use. These are statutory time limits, subject to the regulation’s conditions. ^W13

The accompanying directive provides for designated establishments or legal representatives with the resources to receive and handle requests. It gives the process a reachable addressee. Whether the data can be read is a separate question: recital 20 states that the regulation should not impose an obligation on providers to decrypt data. ^{W14 W13}

Section 2523 of Title 18 of the US Code draws a similar distinction. The executive agreements it governs must create neither an obligation for providers to be capable of decrypting data nor a restriction preventing them from doing so. The clause applies to those agreements. It shows how a cooperation mechanism can organize access while leaving technical capability to its own legal framework. ^W05

The potential economic gain from a more direct route lies in reducing the search for the right contact, administrative exchanges and waiting time. It remains to be measured. The EU regulation calls for statistics on requests executed or refused, average response times, and costs claimed or reimbursed. Its application begins a period of observation; the date alone says nothing about performance. ^W13

Method and scope

Qualitative legal diagram of Regulation (EU) 2023/1543, generally applicable from 18 August 2026, and Directive 2023/1544. EPOC is the European Production Order Certificate. Ten-day and eight-hour deadlines run from its receipt. Where notification is required, data are promptly preserved and transmitted when ten days expire if no refusal ground has been invoked, or earlier after the enforcing authority expressly confirms that it will invoke none. A statutory emergency requires transmission within eight hours. Where that emergency requires notification, the authority has 96 hours from receipt of the notification to oppose use or impose conditions. Arrows show procedure, without a shared time scale or observed performance. Conditions, refusal grounds and remedies apply; the legislation creates no obligation to decrypt.

The resources behind an investigation budget

The US wiretap report provides a concrete reference point: US$92,963, the average reported cost of installation and monitoring for the 804 authorizations with cost data in the report covering 2025. The instructions request approximate personnel and resource costs, including transcription time and equipment amortization or rental. Several wiretaps may be consolidated in a single cost report. ^W01

This amount, in current dollars, describes an operation involving human work. Deriving a price per unlocked phone or solved case would require different information. To compare investments, we would need to know what evidence was obtained, what work would otherwise have been necessary and which resources were actually consumed. A tool used across cases, a team assigned for several weeks and a one-off purchase each distribute costs differently over time.

Europol’s October 2026 assessment details the supporting work: selecting and validating tools, licenses, maintenance, training, and difficulties exchanging data between formats. Developing an in-house solution also requires documentation and ongoing support. The report draws on consultations, stakeholder discussions and documentary research. It identifies needs, without providing a representative measure of cost per investigation. ^W18

China supplies a modest but recent observation. An official notice published on 3 November 2026 announced a 352,800 yuan contract award for digital evidence collection equipment for the market regulator in Yongkang, Zhejiang. The amount covers an equipment order awarded to a supplier. The notice distinguishes a workstation for collecting data from phones from another bundle of equipment. Actual payment, ongoing operating costs and unlocking performance are outside what it establishes. ^W10

The case documents a hardware investment by an economic regulatory authority. Its scope differs from US wiretap expenditure: comparing the two amounts as competing prices would strip away the activities they finance. The sources consulted yielded no comparable Chinese series measuring the full cost or success rate of access. The full notice on China’s government procurement portal, CCGP, was verified; its attachments remain outside the material examined. ^W10

China’s legal framework also requires network operators to provide technical support and assistance to public security and state security bodies in their lawful national security activities and criminal investigations. The obligation appears in Article 30 of the Cybersecurity Law, in the revised version effective from 1 January 2026. The text establishes a duty to assist. Possession of a key, the content of a response and the success of an operation each require their own evidence. ^W09

Turning access into evidence that can be examined

Obtaining files begins another phase of work. The chain of custody documents handling and transfers so that integrity can be checked. Their integrity must be preserved, their provenance documented and their content interpreted alongside other evidence. A readable conversation can still leave questions about identity or context. Europol emphasizes tool validation and traceability; for uses of artificial intelligence, it also calls for outputs to be documented and verified where required. ^W18

China’s 2016 rules on electronic evidence make this sequence explicit. They govern collection, copying, record keeping and integrity checks. Article 25 calls for an overall assessment when linking an online identity to a person, considering factors including IP addresses, activity, device associations and other evidence in the case. These are procedural requirements. The text describes the formal framework; assessing its implementation requires observation of actual practice. ^W08

In Europe, the Court of Justice’s judgment of 30 April 2024 on EncroChat data highlights the judicial stage. Among other issues, it concerns the transfer of evidence already held by another state. Courts must disregard evidence where the defendant cannot comment on it effectively and it is likely to have a preponderant influence on the findings of fact. Both conditions matter. National courts apply these rules to the case before them. ^W12

Protections also apply to access to a phone. In its judgment of 4 October 2024, the Court requires a sufficiently precise legal framework, an assessment of proportionality and prior review by a judge or an independent authority, except in duly justified emergencies. Even an unsuccessful attempt at access falls within the data protection framework examined. The potentially far-reaching intrusion requires attention to the scope of the access sought. ^W17

These requirements have an economic as well as a judicial function: directing resources toward evidence that can be checked and used. They take work, as does executing the initial request. The SIRIUS report titled “2025,” published by Eurojust in August 2026 and mainly covering experiences from 2024, draws attention to the resources providers commit. A request handled without a specific invoice may still occupy lawyers and technical teams. The price charged therefore leaves some of the resources used out of the observer’s view. ^W15

A useful vulnerability can expose other users

Some access techniques rely on a vulnerability: a flaw that allows software to behave in a way its security protections should prevent. Knowing about it can help an authorized investigation. If other users have the same flaw, leaving it unpatched also creates an opportunity for other actors. The likelihood of independent discovery, the prevalence of the product and the effectiveness of safeguards all bear on this trade-off. The US Vulnerabilities Equities Process, published in 2017, includes them among its criteria. ^W20

This creates an externality: a decision that benefits an operation can leave some of its risks with people outside that operation. The scale depends on the flaw, the versions exposed and what other attackers might do with it. The public record is insufficient to estimate an expected monetary loss. It does identify the question to ask: who benefits from retaining an access capability, and who remains exposed in the meantime? ^{W19 W20}

In a 2014 paper on lawful hacking, Steven Bellovin, Matt Blaze, Sandy Clark and Susan Landau proposed using access through existing vulnerabilities as an alternative to mandated changes across systems. Their proposal included a default rule: promptly notify vendors of discovered flaws, even at the cost of a shorter-lived investigative capability. The authors also discussed exceptions. This was a proposal by researchers. It makes the opportunity cost of retaining a vulnerability explicit. ^W19

The US framework made public in 2017 provides for weighing disclosure against temporary restrictions on information, with intermediate options and a review of retention decisions at least annually. This historical document describes a process and its criteria. It provides no record of the operational decisions taken in 2026. ^W20

China organizes the flow of this information through a different framework. Rules that took effect in September 2021 require network product providers, among other duties, to report vulnerabilities to the Ministry of Industry and Information Technology’s platform within two days. They regulate disclosure before a fix is available. The restriction on supplying unpublished vulnerability information to foreign organizations or individuals contains an explicit exception for the provider of the product concerned. ^W07

The two-day deadline concerns reporting. Remediation follows its own sequence: verifying the flaw, preparing a fix and installing it on users’ systems. The Chinese rule sets out obligations; it provides no measurement of the time that sequence actually takes or of the use made of each reported vulnerability. The same care is needed when reading a US framework or an academic proposal. A published procedure and an observed practice supply different kinds of evidence. ^{W07 W19 W20}

Method and scope

Qualitative explanatory model, without estimated probability or duration. Temporarily restricted disclosure may preserve investigative use; notifying the vendor may lead to preparing and deploying a patch, depending on permissions, versions and safeguards. Stages may be revisited. Bellovin, Blaze, Clark and Landau propose rapid notification by default in 2014, with exceptions discussed, even at the cost of shorter useful investigative access. The US VEP published in 2017 sets out assessment and review of retention decisions at least annually; this historical source does not describe secret decisions in 2026. China’s 2021 rules require network-product providers to report to MIIT within two days. This deadline concerns reporting; patch deployment has its own path. The product vendor falls within an exception to the restriction on communicating non-public vulnerabilities abroad. The two legal frameworks remain distinct.

Which additional capability is worth funding?

The strongest objection to alternatives concerns urgency and coverage. An investigation may require specific content on an inaccessible device, on a timetable too short to develop or find a solution. The National Academies describe these limitations. The US figures for 2025, meanwhile, show how often an obstacle is reported among wiretaps involving encryption. A serious comparison has to account for these constraints. ^{W21 W01}

The roadmap presented by the European Commission on 24 June 2025 addresses needs in access, extraction, skills and resources. It envisages technical work on encryption, with the ambition of reconciling lawful access, cybersecurity and fundamental rights. That ambition is a program to be evaluated. Each proposed solution will still have to demonstrate what it makes accessible and how it affects the security of the systems involved. ^W16

A useful comparison would follow sufficiently similar cases to examine the additional gain: evidence obtained, time taken, work committed, verification and eventual use in court. It would account separately for costs borne by providers and any exposure of third parties. This is an evaluation framework proposed here in response to the limits of the available material. The public reports consulted do not supply everything needed to calculate an overall monetary advantage for either policy.

The documents support a more concrete conclusion. Several routes to evidence exist, and some have produced documented results. Their usefulness depends on the information sought and the organization pursuing it. Funding additional access therefore also means funding what makes it useful: people able to assess its scope, verify the data obtained and present a case that a judge can examine. The debate over a backdoor becomes more precise when it begins with that sequence of work.

Documentary research closed on 7 November 2026. Operations are described at the level needed for the economic analysis; no intrusion procedures are provided. The references specify versions, dates and the scope of the documents. Figures retain their units and scope; diagrams without a quantitative scale are identified as such.

Further reading

The first part on the French proposal examines the parliamentary debate. The second on devices and backups follows copies of a business secret; the third on state access examines oversight. The fourth on iCloud and borders explores safeguards and switching costs, followed by the fifth on hijacked access on damage and its distribution.

The sharing image depicts several routes around a protected message: a device, metadata, authorization and examination of the material collected. This conceptual composition illustrates the diversity of sources; it depicts no actual operation or method guaranteeing access to content.

Sources

1. W01 · Administrative Office of the US Courts · Accessed 7 November 2026Wiretap Report 2025 : report, scope and WT-2 reporting instructions
   Passages and scope

   The 2025 US report lists 1,735 reported authorizations. Encryption appears in 296 federal and 229 state reports; plaintext access was prevented in 269 and 217 respectively: 486/525, or 92.6%. Federal guidance covers the overall investigation, while older state guidance covers intercepted communications. Average costs of $92,963 concern 804 reports, sometimes consolidated. Another 329 authorizations lack prosecutor reports; FISA intelligence intercepts are outside scope. These administrative units provide no case-clearance rate.

   Additional document

   Additional document

   Additional document

   Additional document

   Additional document

2. W02 · Signal · 2026-11-03 · Accessed 7 November 2026Grand jury subpoena for Signal user data in the United States District Court for the District of Columbia (again!)
   Passages and scope

   Signal’s November 3, 2026 publication includes redacted documents: an October 5 request concerning four numbers and an October 6 ACLU response covering three nonexistent accounts and one account with responsive records. The letter describes the retained categories as the account-creation date and time, followed by the date of its last server connection. The attached table confirms that scope; identifiers and values are redacted. This provider-published case supplies neither a general judicial outcome nor an independent audit of retention practices.

   Additional document

   Additional document

3. W03 · US Department of Justice, Office of the Inspector General · 2018-03-27 · Accessed 7 November 2026A Special Inquiry Regarding the Accuracy of FBI Statements Concerning its Capabilities to Exploit an iPhone Seized During the San Bernardino Terror Attack Investigation
   Passages and scope

   The Justice Department Inspector General’s March 2018 report, sections I and III–VI, records a possible outside method reported to the court on March 21, 2016, and successful access to the San Bernardino iPhone reported on March 28. It identifies deficient internal coordination while finding the FBI’s initial statements accurate when made, given the capabilities then established. This individual case documents a technical solution and organizational delays, with no general success rate for unlocking tools.

   Additional document

4. W04 · US Attorney’s Office, Southern District of California / US Department of Justice · 2025-02-07 · Accessed 7 November 2026All Extradited Distributors of ANOM Hardened Encrypted Devices Plead Guilty to Racketeering Conspiracy
   Passages and scope

   The San Diego federal prosecutor’s February 7, 2025 release says all eight ANOM distributors extradited by that date, among seventeen people indicted in 2021, had pleaded guilty. It describes a network secretly operated by the FBI, distributed on more than 12,000 devices in 100 countries. These dated outcomes concern that particular police operation rather than decryption of ordinary commercial messaging services or a general case-clearance rate.

5. W05 · Office of the Law Revision Counsel, US House of Representatives; additional DOJ statement · Accessed 7 November 202618 U.S.C. §2523 : Executive agreements on access to data by foreign governments
   Passages and scope

   18 U.S.C. § 2523, particularly (b)(3) and (b)(4)(D)(iii), governs CLOUD Act executive agreements. Agreement terms cannot create a duty to maintain decryption capability; production duties must arise from the requesting authority’s domestic law. The Justice Department’s August 28, 2026 speech explains its cooperation and conflict-of-law objectives. It establishes the department’s position; actual time and cost savings require separate evaluation.

   Additional document

6. W06 · Congressional Research Service; original report archived by EveryCRSReport · 2026-10-29 · Accessed 7 November 2026Law Enforcement and Technology: The ‘Lawful Access’ Debate : IF11769
   Passages and scope

   A copy of CRS report IF11769 dated October 29, 2026, preserved by EveryCRSReport. It distinguishes intercepted content, connection records and stored data, then discusses legislative and operational options. The figures 525 and 486 are checked directly against the official courts report, reference W01. Congress.gov supplies the official report record; the official version available through that access remains dated January 12, 2026.

   Additional document

   Additional document

7. W07 · Ministry of Industry and Information Technology, Cyberspace Administration of China and Ministry of Public Security · 2021-07-13 · Accessed 7 November 2026网络产品安全漏洞管理规定 : Provisions on the Management of Security Vulnerabilities in Network Products
   Passages and scope

   Joint MIIT, CAC and Ministry of Public Security rules, adopted on 12 July 2021 and effective from 1 September. Articles 7(II) and 9(I), (V), (VII) distinguish a provider’s two-day vulnerability report, timely remediation and regulated disclosure. The exception for the affected product’s vendor also covers a foreign vendor. The two-day requirement concerns reporting; actual patching speed and operational use of collected information require separate evidence.

   Additional document

8. W08 · Supreme People’s Court, Supreme People’s Procuratorate and Ministry of Public Security · 2016-09-20 · Accessed 7 November 2026关于办理刑事案件收集提取和审查判断电子数据若干问题的规定 : Provisions on collecting, extracting, reviewing and assessing electronic data in criminal cases
   Passages and scope

   Joint Supreme People’s Court, Supreme People’s Procuratorate and Ministry of Public Security rules, published on 20 September 2016 and effective on 1 October. Articles 5, 7, 16 and 22 to 28 cover integrity, collection, examination and challenges to electronic evidence. Article 25 provides for combining IP addresses, activity, device association and other evidence when assessing identity. These are formal evidential rules. Actual practice and the ability to access a device require separate observation.

   Additional document

9. W09 · Standing Committee of the National People’s Congress; consolidated text published by the CAC · 2025-12-29 · Accessed 7 November 2026中华人民共和国网络安全法 : Cybersecurity Law of the People’s Republic of China, as revised in 2025
   Passages and scope

   Consolidated text published by the CAC on 29 December 2025, Article 30: network operators must provide technical support and assistance for lawful national-security and criminal-investigation activities of public-security and state-security bodies. Previously Article 28, the provision was renumbered following the amendment adopted on 28 October 2025 and effective from 1 January 2026. The earlier text and amendment establish that chronology. A legal assistance duty remains distinct from possession of decryption keys and successful extraction.

   Additional document

   Additional document

10. W10 · China Government Procurement Network; notice for Yongkang’s market regulator · 2026-11-03 · Accessed 7 November 2026永康市市场监督管理局电子数据取证设备采购项目中标(成交)结果公告 : Award notice for digital evidence equipment for the Yongkang market regulator
    Passages and scope

    Official CCGP award notice, 3 November 2026 at 11:38, project 330784267010010000042-DTCG-YK2026-067, sections III, IV and VI. Hangzhou Pinghang received an equipment award for Yongkang’s market-regulation authority: CNY 352,800, comprising one PM416 station at CNY 254,800 and a PC502 and other equipment lot at CNY 98,000. A CNY 5,292 agency fee appears separately. These are nominal award amounts for a local procurement. Payment, lifetime operating costs and device-unlocking performance remain to be established.

11. W11 · Eurojust, with the French and Dutch authorities and Europol · 2023-06-27 · Accessed 7 November 2026Dismantling encrypted criminal EncroChat communications leads to over 6,500 arrests and close to EUR900 million seized
    Passages and scope

    Eurojust’s June 27, 2023 release on EncroChat, with Europol and French and Dutch authorities, reports 6,558 arrests as of that announcement, three years after the operation. A technical intervention enabled analysis of communications on a targeted service at scale. Arrests, convictions, seized money and frozen assets are separate outcomes. The historical figure supplies no updated November 2026 total.

    Additional document

12. W12 · Court of Justice of the European Union, Grand Chamber · 2024-04-30 · Accessed 7 November 2026Judgment in M.N. (EncroChat), C-670/22, ECLI:EU:C:2024:372
    Passages and scope

    CJEU Grand Chamber, 30 April 2024, C-670/22, ECLI:EU:C:2024:372. Paragraphs 75 to 105, 110 to 131 and operative part address transmission of EncroChat evidence already held by another state, procedural conditions and defence rights. Point 5 requires exclusion where the accused cannot comment effectively AND the material is likely to have a preponderant influence on findings of fact. Both conditions matter. National courts apply the rules to the particular case.

    Additional document

13. W13 · European Parliament and Council / Official Journal · 2023-07-28 · Accessed 7 November 2026Regulation (EU) 2023/1543 on European Production Orders and European Preservation Orders for electronic evidence in criminal proceedings
    Passages and scope

    Regulation (EU) 2023/1543 of 12 July 2023 generally applies from 18 August 2026. Article 10 requires production within ten days without notification; with notification, at the deadline without refusal or following early confirmation. In emergencies, production is due within eight hours of receipt of the EPOC; objections to use or conditions may follow within 96 hours of notification. Articles 8 and 12 govern notification and refusal. Recital 20 introduces no decryption duty. Articles 14, 28 and 34 address costs, statistics and dates. These are legal requirements, distinct from measured performance.

    Additional document

14. W14 · European Parliament and Council / Official Journal · 2023-07-28 · Accessed 7 November 2026Directive (EU) 2023/1544 on designated establishments and legal representatives for gathering electronic evidence in criminal proceedings
    Passages and scope

    Directive (EU) 2023/1544 of 12 July 2023, Articles 3, 4 and 7: designated establishments, legal representatives and resources to receive and execute relevant decisions. Transposition was due by 18 February 2026; designation by 18 August for providers already active on 18 February, followed by six months for later entrants. This creates a legally reachable recipient. Compliance by each state or provider, data availability and possession of decryption keys require separate verification.

15. W15 · Europol and Eurojust · 2026-08-27 · Accessed 7 November 2026SIRIUS Electronic Evidence Situation Report 2025
    Passages and scope

    SIRIUS report bearing the year 2025, published by Eurojust on 27 August 2026, chiefly covering experiences from 2024. Methodology: printed pages 18 and 19; costs: pages 53 and 54. It describes staff, technical processing, legal review and internal systems. The EU judicial survey collected 63 voluntary responses across 27 states. Its 8% figure refers to respondents who encountered a reimbursement request, with limited question-level denominator detail. These indicative findings predate application of the EU regulation.

    Additional document

    Additional document

16. W16 · European Commission; Council of the European Union follow-up note · 2025-06-24 · Accessed 7 November 2026Roadmap for lawful and effective access to data for law enforcement : COM(2025) 349 final, with Council follow-up 5424/26
    Passages and scope

    European Commission COM(2025) 349, 24 June 2025, sections III to V: forensic capabilities, access to encrypted data and standardisation. Council Presidency note 5424/26 of 23 January 2026 describes planned first-half activities and expects technology-roadmap results in the fourth quarter. These documents set out an institutional diagnosis and programme. An announced milestone remains distinct from a verified delivery; the safety and effectiveness of any future solution require their own assessment.

    Additional document

17. W17 · Court of Justice of the European Union, Grand Chamber · 2024-10-04 · Accessed 7 November 2026Judgment in Bezirkshauptmannschaft Landeck, C-548/21, ECLI:EU:C:2024:830
    Passages and scope

    CJEU Grand Chamber, 4 October 2024, C-548/21, ECLI:EU:C:2024:830. Paragraph 72 includes attempted access to phone data within processing even where technical access fails. Paragraphs 93 to 110 and the operative part require sufficiently precise rules, proportionality and prior review by a judge or independent administrative authority, except for duly justified urgency followed by prompt review. The judgment also addresses notice and remedies. It defines legal safeguards rather than measuring unlocking tools’ capabilities.

    Additional document

18. W18 · Europol, with the European Commission / Publications Office of the European Union · 2026-10-16 · Accessed 7 November 2026Digital forensics: gap analysis
    Passages and scope

    Europol and European Commission, Digital forensics: gap analysis, published on 16 October 2026. Physical PDF pages 5 to 9 and 19 to 21 cover tool selection and validation, maintenance, licences, training, interoperability and traceability in AI-assisted analysis. Its methodology draws on stakeholder consultations, meetings, surveys and documentary research. The report identifies needs and proposes shared capabilities. This institutional diagnosis offers neither a representative cost per investigation nor a causal estimate of productivity gains.

    Additional document

    Additional document

19. W19 · Steven M. Bellovin, Matt Blaze, Sandy Clark and Susan Landau / Northwestern Journal of Technology and Intellectual Property, vol. 12, no. 1 · 2014-04 · Accessed 7 November 2026Lawful Hacking: Using Existing Vulnerabilities for Wiretapping on the Internet
    Passages and scope

    Steven M. Bellovin, Matt Blaze, Sandy Clark and Susan Landau, Northwestern Journal of Technology and Intellectual Property, April 2014, volume 12, number 1. Paragraphs 162 to 164, printed page 54 onward, and 174 propose targeted exploitation combined with prompt vulnerability reporting as the default. The authors examine shorter-lived investigative capabilities, risks to third parties and exceptions. This historical, argued proposal remains distinct from a scientific consensus or a measurement of prices and capabilities in 2026.

    Additional document

20. W20 · Executive Office of the President / archived White House document · 2017-11-15 · Accessed 7 November 2026Vulnerabilities Equities Policy and Process for the United States Government
    Passages and scope

    White House, Vulnerabilities Equities Policy and Process, 15 November 2017. Sections 1 and 2, 5.2.5 and Annex B cover disclosure or restriction, mitigation options, affected-product reach and independent discovery. Restricted information is to be reassessed annually until disclosure, public knowledge or other mitigation. The archived document explains a historical procedure and its published criteria. Decisions, results and operational practice in 2026 remain outside the evidence it provides.

    Additional document

21. W21 · National Academies of Sciences, Engineering, and Medicine · 2018 · Accessed 7 November 2026Decrypting the Encryption Debate: A Framework for Decision Makers : Chapter 5, Options for Accessing Plaintext
    Passages and scope

    The National Academies’ 2018 consensus report, chapter 5, particularly pages 70–75, examines metadata, provider-accessible backups, targeted exploitation, analytical tools, training and shared expertise. Their usefulness depends on the data actually available, applicable law and resources; scalability also presents limits. This historical analytical framework supports complementary investigative approaches without guaranteeing recovery of every encrypted message.

    Additional document