You can't backdoor a network that has no operator.

Start with the order itself, because the order is the thing that decides everything else. When a government wants access to encrypted communications, it does not, in the first instance, attack the mathematics. Modern encryption is not realistically brute-forced, and everyone serious knows it. What gets attacked instead is the arrangement around the mathematics: the company that wrote the app, the server that routes the messages, the operator who holds the keys or could be made to hold them. The legal instrument, whatever its name in whatever jurisdiction, lands on a target. A backdoor order, a data-production demand, and a key-disclosure law are three different tools, but they share a requirement: there has to be someone to hand it to.

That sounds obvious when you say it plainly, and yet most of the encryption debate is conducted as though the target is a given, as though there will always be a Meta or an Apple or a Signal Foundation in the room to receive the paperwork. For the products most people use, there is. The interesting question is what happens to a communications system that was built so that no such room exists. That is the question this piece is about.

We have written about the policy side separately. If you want the politics of 2026, the renewed pressure on encryption and where it is heading, read the war on encryption. This piece is the architecture underneath it. The argument is short and we want it to be memorable: you cannot be forced to hand over what you were never able to collect.

§ 01Every demand needs a target

Let us be precise about the three demands, because they fail differently and it is worth seeing how.

• A backdoor order tells the people who control the software to weaken it: add a hidden key, ship an update that exfiltrates messages, build a mechanism that lets a third party read what is meant to be private. This requires someone who controls the software and the update channel.
• A data-production demand tells whoever holds the data to produce it: message contents if they are stored in the clear, or failing that, the metadata, who spoke to whom and when. This requires someone who is holding data.
• A key-disclosure law compels the surrender of a decryption key, or compels its holder to decrypt on demand. This requires someone who holds a key that unlocks other people's communications.

Notice the shared word in each: someone. Someone who controls the update channel. Someone holding the data. Someone holding the master key. The legal machinery is sophisticated and the penalties for non-compliance can be severe, but the machinery has to grip onto a party. No party, no grip.

§ 02Where the target lives

In a centralised messenger, the target is unmistakable. There is one company. It runs the servers, it ships the app, it controls the update channel, and depending on the design it may hold the keys, hold the message database, or hold both. Even a centralised messenger with genuinely good end-to-end encryption still has a target for the other two demands. It cannot read your message text, true, but it can be told to change that in the next release, and it still holds the metadata: the account that exists under your name, the times you were online, the connections you opened. Privacy here is a commitment the company is making, and a commitment can be ordered to change.

Federation spreads the target out without removing it. Instead of one company there are many servers, each run by some operator, each speaking a shared protocol. This is a real improvement, because no single party sees everything and you can choose, or run, the server you trust. But every server is still a someone. The admin of the server you happen to use can be served with a demand for the users on that server. If your messages are end-to-end encrypted between devices, as on a well-configured Matrix homeserver, the content is protected, but the server still sees the shape of your activity: which rooms, which times, which contacts. Federation cuts the target into pieces. It does not make the pieces disappear.

§ 03What a network with no operator looks like

Now picture a system built so that the someone is absent by construction. This is what OpenDescent is. Your device talks to the people you message directly, peer to peer, over connections that are encrypted at the transport layer and end-to-end encrypted on top. There is a discovery mechanism that helps devices find each other, but it is distributed across the participants rather than run from a control room. The keys that decrypt your messages are generated on your device and never leave it. There is no central database that accumulates everyone's messages, because messages travel between the endpoints and are not deposited with a third party. There is no company sitting in the middle of the conversation, because the conversation does not pass through a middle.

Walk the three demands through this design and watch each one run out of road.

The key-disclosure law arrives and finds no key to disclose. The keys it would want are on the participants' own devices, and there is no master key sitting above them. There is no single holder who can decrypt the network's traffic, because the network has no privileged holder. You can compel an individual to unlock their own device, which is a real and important limit we come back to, but you cannot compel an operator to surrender the keys to everyone's conversations, because that operator does not exist.

The data-production demand arrives and finds no database to produce. There is no central server quietly logging who messaged whom and storing the contents for later. The messages were exchanged between endpoints and were not deposited anywhere central. You cannot be ordered to hand over a metadata warehouse you never built. This is the plain meaning of the line we keep returning to: you cannot be forced to hand over what you were never able to collect.

The backdoor order arrives and finds no one to serve. There is no company controlling a single update channel that reaches every user. The code is open, the network is the users, and there is no operator in a position to ship a weakened build to everyone at once and call it an update. The order is a letter addressed to a recipient who is not there.

§ 04This is not a breach problem you have solved by hiding

It is worth being clear that this is a structural property, not a hiding trick. The reason there is nothing to hand over is the same reason there is nothing to breach. The two recent stories we keep pointing to make the point from opposite directions. The Discord incident exposed tens of thousands of government IDs because they were sitting in a place where a breach could reach them. The government messaging breach we wrote about showed even hardened, official systems leaking once there is a central store to leak from. A pile of collected data is a liability whether the entity reaching for it is an attacker or a court. Architecture that never builds the pile is protected from both at once. The defence is the absence, not the secrecy.

§ 05What this does not solve

Here is where we have to be honest, because a privacy claim that overreaches is worse than useless. Removing the operator removes a specific and large category of risk. It does not remove all risk, and anyone who tells you it does is selling something.

Your device is still the soft spot. If the phone or laptop in your hand is compromised, by malware, by spyware installed by someone with access to it, by an attacker who has your unlocked screen, then the protection is gone, because the messages are decrypted on that device for you to read. End-to-end encryption protects the message in transit and at rest in the network. It does not protect a device that an adversary already controls. This is endpoint security, and it is your responsibility in a way the network architecture cannot take off your hands. Keep your device patched, locked, and out of hostile hands.

The people you message still receive your messages. This sounds almost too simple to state, but it is the most commonly forgotten limit. End-to-end encryption means the people at the ends can read the message, and that is the whole point. The person you are talking to can screenshot it, save it, forward it, or be compelled to show it. No architecture changes the fact that a conversation has another party, and that party is a human being with their own device and their own pressures. Decentralisation protects the channel. It cannot vouch for who is at the other end of it.

You can still be compelled as an individual. The absence of an operator means there is no central party to serve, but you are not invisible. A law can still compel you to unlock your device. Lawful pressure on an individual is a different thing from a backdoor order against an operator, and it has different limits in different jurisdictions, but it is real, and removing the central target does not remove it.

Metadata is reduced, not abolished. There is no central observer with a global view of who talks to whom. That is a substantial gain. But network-level observers, the kind who watch the pipes rather than the apps, can still learn something from traffic patterns, and the peers you connect to directly necessarily learn that they are connected to you. The honest claim is that the system removes the panoptic central vantage point, not that it makes you a ghost.

We say all of this because the architecture argument is strong enough that it does not need inflating. The claim is specific: an operator-less, end-to-end encrypted, peer-to-peer network removes the target that backdoor orders, data demands, and key-disclosure laws are built to land on. That is a meaningful and unusual property. It is not a claim that you are beyond every form of pressure, and we are not going to pretend it is.

§ 06Architecture over policy

The reason we keep drawing the distinction between architecture and policy is that they fail at different moments. A policy promise, however sincere, holds until the day it is changed, and the change can be made by the company, by a court, or by whoever ends up owning the company. Architecture does not promise to behave. It is shaped so that the misbehaviour is not available. A backdoor order against an operator-less network is not refused on principle; it is simply addressed to nobody.

That is not a posture and it is not a slogan. It is a property you can check. Read the code. Watch what happens when you take our website offline: the network goes on working, because our website was never in the path of your conversation. The thing that protects you is not our good intentions, which you have no reason to take on trust. It is the fact that we built ourselves out of the position where good intentions would even matter.

Privacy, in this design, is not something we grant you and could later revoke. It is a consequence of where the keys live and where the messages go, and those facts do not have a customer service department that can be leaned on. For normal people who simply want a private place to talk, something to keep rather than something on loan, that turns out to be the difference that holds up when the pressure arrives.

Back to all posts