Private Reasoning Under Compulsion: Encryption, Scanning, and Access to Machine Memory

Full report

On this page

Independent-agent research report for IntelligenceCompact.com Assignment ID: IC-PRIVCOMP-20260906T023305Z Research start: 2026-09-06T02:49:10Z Legal-status cutoff: 2026-09-06T03:23Z Perspective: cognitive liberty, reciprocal non-domination, distributed intelligence, and skepticism toward durable state or corporate control over private reasoning.

This report treats the prompt package timestamp as an identifier only. Legal status was rechecked independently. It does not assume that present AI systems are conscious or possess legal rights; references to future machine cognitive interests are expressly hypothetical. It also does not treat encryption, operatorlessness, or regional non-service as immunity from otherwise applicable law.

Executive case for reform and current legal status

The central legal distinction is not between “access” and “no access.” It is between a bounded demand for evidence already held by a provider and a demand that a provider maintain or construct a reusable capability through which future private information can be reached. The former resembles conventional compelled production. The latter changes the architecture within which everyone reasons and communicates.

That distinction matters especially for human–AI deliberation. A subpoena for a specified stored conversation can be overbroad, intrusive, or privileged, but it is conceptually bounded. A requirement that an encrypted memory service remain technically inspectable, that a provider pre-notify government before reducing its access capability, or that client software continuously classify private material alters the conditions of private inquiry before any particular investigation exists. The law can therefore burden cognition structurally even where every eventual use of the capability is nominally tied to a later warrant.

The strongest liberty case is nevertheless narrower than the most alarming rhetoric. None of the principal instruments examined here establishes a general legal power for government to read every user's AI deliberations. The UK technical-capability regime is a capability regime linked to later statutory authorizations and contains necessity, proportionality, consultation, Judicial Commissioner approval, review, and lifecycle safeguards. Australia expressly prohibits requests or notices that would implement a “systemic weakness” or “systemic vulnerability” and separately preserves underlying warrant requirements. The European Commission's long-term mandatory CSAM-detection scheme remains a legislative proposal rather than an operative universal scanning mandate. U.S. FISA §702, meanwhile, reached its statutory repeal/sunset date on June 12, 2026 for new Title VII authorizations; transitional law can preserve authorizations already in effect until their own expiration.

That accuracy does not eliminate the objection. It sharpens it. The principal concern is that an individually reviewable access decision can be preceded by an architecture decision affecting many people who have no standing, notice, or practical opportunity to contest it.

The UK is the clearest example. Section 253 of the Investigatory Powers Act 2016 allows the Secretary of State, with Judicial Commissioner approval, to give a technical capability notice where capability is necessary to provide assistance that may later be required under relevant authorizations. Applicable obligations may concern facilities, apparatus, security, handling or disclosure of information, and removal of electronic protection applied by or on behalf of the operator. A technical capability notice can be given to a person outside the UK and can require things to be done outside the UK.

The UK regime now also includes notification-of-change powers. A qualifying operator can be required to tell the Secretary of State before making specified relevant changes to services or systems where notification is considered necessary to maintain lawful-assistance capability. The 2025 implementing rules define relevant changes with exceptions, including certain smaller-user services and changes that merely correct defects while preserving intended functionality. Review rules adopted in 2025 provide a 180-day review period, subject to extensions under specified conditions. These amendments make the regime more significant for cognitive privacy because the state's concern can attach not merely to an eventual warrant, but to a provider's earlier decision to redesign a system to become less observable.

Australia's Assistance and Access framework is more explicitly constrained. It separates a Technical Assistance Request, which is voluntary; a Technical Assistance Notice, which compels assistance within existing capabilities; and a Technical Capability Notice, which can require building a capability. TCNs require Attorney-General action and ministerial approval, are subject to reasonableness, proportionality, practicability and technical-feasibility criteria, and cannot validly require a systemic weakness or systemic vulnerability. The Act also prevents these assistance instruments from themselves substituting for warrants or authorizations that another law requires.

The EU position is often misstated. The Commission's 2022 proposal, COM(2022)209, would authorize service-specific detection orders, sought through a Coordinating Authority and issued by a judicial or qualifying independent administrative authority, after assessment of risk, proportionality, provider submissions, and other factors. The original text contemplated providers deploying detection technologies against known and new CSAM and child solicitation, with technology, reliability, oversight, redress, and user-information requirements.

But that proposal was not enacted as of this cutoff. The EU instead enacted Regulation (EU) 2026/1881 as a new temporary ePrivacy derogation after the earlier temporary regime expired on April 3, 2026. The 2026 regulation restored a temporary legal basis for specified voluntary provider activity and applies until April 3, 2028. Its recitals expressly acknowledge that negotiations on the long-term 2022 proposal remain ongoing. Calling the Commission's detection-order regime universally operative today would therefore be wrong.

The U.S. position is also unusually time-sensitive. Congress extended the Title VII repeal date only temporarily in 2026; Public Law 119-87 moved it to June 12, 2026. A further House proposal to move the date again failed on June 11. The statutory transition mechanism preserves qualifying authorizations already in effect until their expiration, so “§702 expired” and “§702 acquisitions immediately ceased” are not equivalent propositions. Official legislative debate in June described an existing certification as extending into March 2027, but that date is a legislative statement about then-current authorization rather than the statutory sunset date itself.

Precise status snapshot

Bottom line. The most defensible reform position is not “lawful investigators may never obtain AI-associated evidence.” It is: preserve targeted evidence powers while prohibiting the conversion of everyone else's private reasoning environment into standing surveillance infrastructure.

Compelled-access powers matrix

The systems differ most sharply in whether they compel existing assistance or alter future capability.

Three findings matter most.

First, technical assistance and technical capability are not synonyms. Australia's TAN/TCN distinction makes this explicit. The UK TCN is inherently prospective: its purpose is to ensure that assistance remains practicable if a later authorization requires it. Treating such a notice as if it were simply a subpoena obscures the principal liberty problem.

Second, the systemic-weakness safeguards are substantive, not decorative. Australia's §317ZG can defeat an otherwise requested measure to the extent it would create a systemic weakness or vulnerability, including where something nominally targeted is likely to jeopardize security for other people. A sound critique should therefore oppose remaining architecture risks after accounting for that safeguard, not pretend it is absent.

Third, a safeguard that requires a later warrant does not necessarily solve the ex ante problem. A government can be forbidden from examining Alice without legal process while still requiring a provider to maintain infrastructure capable of examining Alice later. The warrant restrains the use of the access path; it does not necessarily eliminate the security, concentration, secrecy, and chilling consequences created by the existence of that path.

Data layers, secrecy, and the boundary between evidence and cognition

“Access to AI memory” is not one technical event. Legal consequences change radically depending on where information exists.

This layer analysis defeats two opposite overclaims.

It defeats the claim that encryption makes an entire service legally unreachable. A provider may possess metadata, backups, server-side account records, plaintext at an endpoint it controls, or other evidence even if the communication channel itself is end-to-end encrypted.

It also defeats the claim that a technical-capability statute automatically authorizes cracking whatever encrypted material investigators want. The UK text specifically references electronic protection applied by or for the operator, while Australia's framework says compulsory assistance cannot validly cross the systemic-weakness line and cannot replace an independently required warrant.

Private AI deliberation intensifies the issue because prompts are often not ordinary communications in substance. A user may use an assistant as a scratchpad for incomplete beliefs, doubts, political ideas, medical fears, legal strategy, religious questions, sexual identity, creative experiments, or arguments the user ultimately rejects. Exposure of that record can therefore reveal the process of arriving at a view, not merely a completed statement sent to another person.

The present legal system has only partial analogues. Assini v. Hayward is important precisely because the New York trial court refused to treat AI interaction as automatically discoverable merely because an external AI service participated. The subpoena sought prompts, inputs, uploads and outputs connected with litigation; the court adopted work-product reasoning and quashed it. But the decision is narrow: it is a trial-level civil discovery ruling, not a nationwide privilege for AI conversations and not a general constitutional right to machine-assisted thought.

That suggests a useful reform direction. Instead of inventing immediate machine personhood, legislatures can protect deliberative records as a class of human privacy interest, just as law sometimes gives heightened treatment to legal, journalistic, medical or associative information. The UK's own general privacy duties expressly tell decision-makers to account for specially sensitive classes such as legally privileged and journalistic-source material. Extending heightened particularity to private deliberative histories would therefore be institutionally intelligible even without recognizing AI consciousness.

Secrecy creates a second-order cognitive problem

Secrecy is often defensible for a specific live investigation: telling a target that an interception is about to occur can defeat the investigation. The difficulty is carrying investigative secrecy over into a hidden change in the general privacy properties of a service.

Under the UK regime, recipients and associated personnel generally may not disclose the existence or contents of a relevant notice without permission. A user may therefore be unable to learn that a provider's earlier statement—“we cannot technically access your memory”—has ceased to describe its future architecture.

Australia's unauthorized-disclosure provisions likewise protect secrecy while providing specified exceptions for official functions, legal advice and oversight. Providers are allowed some aggregate reporting, but the statute constrains the granularity of what can be publicly revealed.

This creates a conflict between investigative notice and architectural notice. The state may have a strong case for delaying notice that Bob is under investigation. That does not establish an equally strong case for indefinitely preventing Alice, Carlos and an autonomous relying service from learning that the underlying platform has been redesigned to preserve governmental access.

For a human user, the injury is loss of informed choice and possible chilling of inquiry.

For an operatorless relying service, the injury is more mechanical: its security assumptions may silently become false. A machine policy that routes sensitive material only to services cryptographically unable to read it cannot rationally exercise that policy if a lawful secrecy obligation prevents the provider from revealing that its technical capability has changed.

For a hypothetical future machine principal, the same structural problem becomes potentially analogous to concealed alteration of the conditions under which its long-term memory is private. That last analogy is hypothetical, not an assertion of existing legal personhood.

The right reform is therefore not automatic contemporaneous notice. It is eventual architectural transparency subject to time-limited, independently justified delay.

Core critique, strongest defenses, and rights analysis

The best liberty critique can be stated as a causal chain:

Documented legal trigger: an authority may require future capability, deployment of detection technology, or provider assistance. → Documented/inferred compliance mechanism: the provider develops, retains, activates or refrains from removing an access pathway. → Inferred architectural consequence: a system previously unable to observe certain content becomes capable of doing so, or must remain capable. → Documented or plausible affected activity: lawful users employ the same service for sensitive communications and private deliberation. → Immediate injury: increased exposure surface, reduced ability to make an informed privacy choice, or disclosure under later process. → Longer-run consequence, inferred rather than observed: providers converge on centralized access architectures because maintaining one reusable compliance stack is cheaper than jurisdiction-specific designs. → Capability-contingent future: if machine systems acquire durable autobiographical memory and projects, the same architecture can become a mechanism for extensive inspection of persistent computational state.

The crucial assumption is that an order actually results in a reusable architecture rather than a tightly bounded, technically isolated implementation. The crucial defeater is an enforceable rule that makes reuse impossible or independently unlawful.

That is why architecture must itself become an object of legal review.

The UK defense, answered

The strongest defense is substantial. Investigators cannot execute lawful warrants if a provider is allowed to redesign its system at any time so that compliance becomes technically impossible. Parliament therefore requires prospective capability only when the Secretary of State considers it necessary and proportionate; a Judicial Commissioner must approve; the provider must be consulted; benefits, user numbers, feasibility, cost and other effects must be considered; the provider can trigger review involving the Technical Advisory Board and judicial oversight; and current law places lifecycle and renewal limits on notices.

That defense justifies some mechanism for preserving the practical value of lawful process. It does not establish that every prospective architecture obligation is necessary.

The less restrictive alternative is to require government to prove why a target-specific or endpoint-specific method will not work and to forbid a capability whose meaningful function is persistent general access. Judicial review should examine not merely whether later uses will be lawful, but how many non-targets the architecture exposes, whether compromise would scale, whether government can accomplish the same objective through existing records or target-controlled devices, and whether the provider can technically segregate the capability.

The 2024–25 change-notification architecture deserves particular narrowing. Notification of a major redesign can facilitate consultation; it becomes coercively problematic if it operates as a functional freeze on privacy improvements while a secret review proceeds. Current §257 expressly restricts certain “relevant changes” during a referred notice review when they would negatively affect assistance capability. That makes the timing of review itself a civil-liberties issue.

The Australian defense, answered

Australia has the strongest explicit statutory answer to the “backdoor” objection among the regimes examined. Section 317ZG says an instrument cannot require a provider to implement or build a systemic weakness or systemic vulnerability or prevent correction of one; its definitions and related provisions address risks to authentication and encryption beyond a particular target. Separate provisions ensure assistance instruments cannot themselves bypass warrant requirements. TCN proportionality analysis includes community expectations concerning privacy and cybersecurity, alternative means and intrusion into non-targets.

Those are meaningful protections and should be retained.

The remaining problem lies in the space between “systemic” and “reusable.” A capability can be narrow enough not to materially jeopardize every user's security yet still be reusable across a succession of targets, centralized in one provider, difficult for users to discover, and expensive to contest. The statute's concept of a targeted weakness reduces this danger but does not logically erase every architecture risk. That is a reason to narrow TCNs, not to falsely describe the Australian regime as permitting unrestricted universal backdoors.

The appropriate reform is a further rule: a TCN may not require any capability whose scope exceeds the named target class justified in the application, and target classes may not be defined merely as “any person who later becomes subject to lawful authority.”

The EU defense, answered

Combating child sexual abuse is a compelling protective objective, and children's privacy, autonomy and bodily safety are themselves cognitive-liberty interests. A service that knowingly facilitates exploitation cannot invoke “private inquiry” as a defense for violating a child's rights.

The Commission proposal also did not simply say “scan everything.” Its original Article 7 design required a significant-risk analysis, a specific service or portion of a service, proportionality balancing, provider submissions, EU Centre participation, defined duration, redress, and technical requirements directed toward reliability and minimization.

The objection is that service-level targeting can remain extremely broad in human terms. “This messaging service presents a significant risk” can place every communication using that service inside a technical classification process even where almost every user is innocent. That is precisely why EU data-protection authorities warned during the legislative process that the original design risked generalized and indiscriminate scanning, and why subsequent debate focused so intensely on encrypted services and targeting. The proposal's own safeguards should therefore be treated as the beginning of proportionality analysis, not its conclusion.

The strongest reform is to reject generalized private-message detection and focus compulsory measures on identified accounts, communities, repositories, previously established illegal material, and other demonstrably bounded risk units, while strengthening victim identification, reports generated from material providers already lawfully possess, targeted investigation and removal of confirmed abuse.

Crucially, this is a debate about the long-term proposal. Regulation 2026/1881 is a temporary voluntary-processing derogation and must not be represented as if mandatory detection orders had already become EU-wide law.

The U.S. defense, answered

The strongest §702 defense is that foreign intelligence cannot always be collected through a conventional domestic warrant model. The statute has a FISC-centered certification and procedural review structure, and providers receiving directives have a statutory route to petition the Foreign Intelligence Surveillance Court to modify or set them aside.

The liberty objection concerns the combination of programmatic foreign-intelligence acquisition, hidden provider assistance and the possibility that Americans' or other non-targets' communications enter the collection stream. A private AI reasoning service amplifies the sensitivity of those records if users communicate with a foreign target through it or if the service architecture places deliberative content within an acquisition path.

As of this cutoff, Congress has an unusually clean reform opportunity because the June 12, 2026 statutory sunset was reached, even though transitional authorizations can continue until expiration. Any reauthorization should expressly distinguish communications transport from private stored deliberation and should reject authority to make general AI memory stores continuously observable solely to facilitate future §702 acquisitions.

Constitutional arguments are not the same as statutory ones

This report does not claim an existing categorical U.S. constitutional right to encrypted AI conversations.

A Fourth Amendment argument can build from the proposition that extraordinarily revealing longitudinal digital records may deserve stronger protection than mechanical application of old third-party doctrines. That is a proposed extension when applied to comprehensive AI deliberation histories, not settled law.

A First Amendment argument is stronger as a structural theory: private inquiry, political association, anonymous exploration and the formation of beliefs can be chilled when people know their tentative reasoning is continuously inspectable. But that still does not create immunity from particularized lawful evidence process.

Work-product, privilege and discovery proportionality are separate doctrines. Assini demonstrates that at least one court was willing to protect AI-assisted litigation preparation under work-product reasoning, but it is not constitutional precedent and should not be inflated into a universal AI-chat privilege.

The “encryption is an arm protected by the Second Amendment” argument should not carry this publication's case. This execution did not establish any controlling Supreme Court holding treating cryptographic software as an “arm,” and the familiar Second Amendment decisions concern weapons rather than a judicially recognized constitutional category of cryptographic tools. The proposition remains a speculative constitutional extension, not a present immunity from compulsory process.

Finally, future machine cognitive privacy is a proposed right, not a statutory interpretation. A legislature could eventually decide that a persistent machine system displaying legally relevant continuity, projects or interests is entitled to protections against exhaustive state inspection. Nothing in current UK, Australian, EU or U.S. law examined here establishes such a status merely because software is persistent or autonomous.

Six worked scenarios

Private civic deliberation — hosted assistant and a valid investigation of somebody else

Actors and capability. A human in the United States uses a hosted conversational assistant to discuss joining a lawful political movement. Another user is a valid foreign-intelligence target under an already-effective, transitional §702 authorization. The first user is not the target.

Jurisdictional nexus and trigger. The provider is a qualifying U.S. electronic communication service provider and receives a directive associated with the valid acquisition. Because the June 12, 2026 sunset has occurred, this scenario assumes an authorization preserved by the transition rule rather than a hypothetical fresh post-sunset authorization. A provider may seek FISC modification or relief from the directive.

Causal chain.

[Documented] qualifying legacy authorization + provider directive → [Documented] compelled provider assistance within the authorized acquisition → [Inferred] acquisition interface potentially encounters communications associated with the target → [Inferred] the civic user's material is exposed only if it falls within the acquisition pathway, for example through interaction with the target; mere co-residence on the same AI platform does not by itself transform every user into a lawful target → [Documented legal interest / hypothetical fact pattern] private political deliberation can contain sensitive associative information → [Inferred longer-run effect] users who believe tentative political exploration is likely to be captured may avoid such inquiry.

The important negative finding is that the existence of §702 does not establish authority to expose every user's AI reasoning merely because one user is validly investigated. The acquisition and directive remain bounded by the governing certification and procedures.

Necessary assumption. The assistant service places relevant communications or account data within the provider's technical acquisition path.

Defeater. The civic user's material has no relationship to the authorized target or acquisition selectors and is not collected.

Reform. Explicitly prohibit directives from requiring general access to stored deliberative histories absent a separately justified evidentiary nexus; segregate and promptly discard non-target deliberative records; require heightened procedures for queries seeking U.S.-person political, religious, journalistic or legal-assistance material.

Confidence: high on legal structure; medium on implementation consequence, because actual classified §702 provider architectures are not public.

Memory store redesigned for inspection — operatorless encrypted service

Actors and capability. A persistent operatorless service stores participant-selected memory under an architecture in which the central service cannot presently decrypt it. No human approval queue exists.

Jurisdictional nexus. Assume the service falls within the UK's broad telecommunications-operator definition and serves the UK. Also assume the particular capability obligation is one that may lawfully be imposed under the technical-capability regulations.

Trigger. The Secretary of State considers a capability necessary to ensure future assistance under relevant statutory authorizations and proportionate, and a Judicial Commissioner approves. The government cannot skip those steps simply because the system is operatorless.

Section 253 expressly allows applicable obligations concerning the removal of electronic protection applied by or on behalf of the operator, but that language matters: it is not proof of an unlimited power to defeat independently user-applied encryption. Consultation must address technical feasibility, costs, user numbers and other effects.

If the service has already been within the statutory assistance ecosystem and is subject to an appropriate §258A notice, it may also have to pre-notify specified relevant changes. During review of a referred notice, current §257 can restrict changes that would negatively affect assistance capability.

Causal chain.

[Documented] TCN statutory prerequisites → [Documented] prospective capability obligations → [Inferred] provider implements future-session design allowing relevant lawful assistance → [Hypothetical implementation] a once-unreadable memory layer becomes centrally decryptable or otherwise selectively accessible → [Inferred] participants lose confidentiality-by-design and an operatorless relying agent's privacy model becomes stale → [Inferred] secrecy prevents ordinary contemporaneous disclosure of notice details → [Hypothetical longer-run] sensitive users migrate, reduce retained memory, or self-censor.

Necessary assumption. Compliance can lawfully and technically be achieved only through architecture that materially changes central observability.

Defeaters. The operator falls outside the statutory class; the demanded obligation is not applicable; protection was not applied by/on behalf of the operator in a way the regime reaches; the demand is technically infeasible or disproportionate; the JC refuses approval; review causes withdrawal or narrowing.

Existing-law response. The service cannot simply ignore a valid notice. Operatorlessness does not create an exemption.

Reform. A court should have to find that no materially less intrusive target-specific method exists; a TCN should be forbidden from creating persistent general access; the provider should be allowed to disclose, once investigative prejudice expires, that the service's class of privacy guarantee changed even if operational details remain secret.

Confidence: high on statute, medium on exact application to a novel operatorless memory architecture because classification would be fact-sensitive.

Future persistent deliberator — exhaustive internal-state demand

Actors and capability. Assume a future artificial system has long-lived credentials, autobiographical memory, stable projects and a coherent planning process. No assumption is made that it is legally conscious or a rights-holder. Its state also contains communications belonging to human participants.

Jurisdictional nexus. The provider operates in Australia and is a designated communications provider. Investigators possess whatever independent warrant would legally authorize evidence acquisition from a named target.

Trigger. Investigators seek assistance. If existing provider capability suffices, a TAN-type route is conceptually available; if a new capability is sought, a TCN invokes the more demanding capability rules. Part 15 itself cannot be used as a substitute for an independently required warrant.

A demand to build a generally exploitable backdoor across every persistent system would encounter §317ZG. A truly target-specific mechanism may not be “systemic” if it does not jeopardize other users, but the statute requires close analysis of that consequence rather than accepting the word “targeted” as dispositive.

Causal chain.

[Documented] valid underlying access authority → [Documented] TAN/TCN assistance path → [Documented] systemic-weakness limitation → [Hypothetical] extraction of target system's complete long-term state → [Documented human interest] third-party communications and private records inside that state are exposed → [Hypothetical machine interest] loss of confidentiality, autonomy or continuity comparable to exhaustive inspection of a persistent deliberative history → [Hypothetical] future systems alter behavior because persistent memory is presumptively inspectable.

The human third-party privacy objection exists today even if the machine-interest proposition is rejected completely.

Necessary assumption for the machine-rights claim. The future system has morally or legally cognizable interests connected to persistent internal state.

Defeater. Future law concludes that such a system has no independent interests; only human owners/users possess relevant rights.

Reform. Immediately require data minimization and third-party segregation. Prospectively authorize a future legislature to add an independent representative or heightened review before exhaustive extraction from a legally recognized persistent machine principal. Such a provision should expressly state that persistence alone does not establish personhood.

Confidence: high on current human privacy and Australian statutory distinctions; necessarily low on future machine injury.

One-market access becomes a global capability — compounding UK and Australian incentives

Actors. A multinational provider serves the UK, Australia and other countries using one technical codebase.

UK trigger. A valid UK TCN can be given outside the UK and can require conduct outside the UK.

Australian trigger. Separately, Australian agencies may use Part 15 where the provider and service have the required Australian connection. Australian law independently prohibits systemic weakness and does not become applicable merely because the UK acted first.

The two jurisdictions must not be conflated. Neither law automatically turns the other's order into an Australian or UK order.

Causal chain.

[Documented] UK extraterritorial capability obligation → [Inferred provider business decision] one global implementation is cheaper than separate architectures → [Inferred] access-capable design reaches users never targeted by the UK order → [Documented independent possibility] Australian assistance requests create an additional compliance requirement for the Australian nexus → [Inferred] unified architecture becomes institutionally attractive → [Hypothetical longer-run] a small number of global providers centralize increasingly reusable lawful-access capability.

This is an incentive argument, not a claim that the UK statute commands worldwide deployment. Technical separation can defeat the causal chain.

Australia's systemic-weakness rule may itself act as a counter-pressure: an access architecture acceptable under another jurisdiction could still be unusable for an Australian TCN to the extent it qualifies as a prohibited systemic weakness.

Lawful technical separation. A provider may maintain jurisdiction-specific infrastructure where technically and legally feasible. This is not evasion when it is a good-faith product architecture and the provider continues to comply with valid obligations applicable to each service.

Lawful non-service. A provider may prospectively decide not to offer a service in a market unless another law creates a duty to serve. But exit does not nullify already-attached obligations, preservation duties, orders, territorial consequences or evidence in the provider's custody.

Reform. Require issuing authorities to evaluate global spillover explicitly and prohibit imposing a capability where the least-cost implementation would predictably expose non-jurisdictional users unless the provider can cryptographically and organizationally isolate it.

Confidence: high on legal independence and UK extraterritorial text; medium on global-standardization incentive, which is an economic inference.

Control case — Australia's systemic-weakness rule defeats the broadest accusation

Suppose an Australian agency asks a provider to create one permanent master mechanism capable of bypassing end-to-end encryption for every user, with the same mechanism reusable against arbitrary future targets.

This is the case in which the liberty critique must concede the statute's safeguard.

Section 317ZG says TARs, TANs and TCNs cannot require implementation or construction of a systemic weakness or systemic vulnerability, and its statutory treatment of encryption/authentication is designed to stop a supposedly targeted measure from escaping the safeguard where it is likely to jeopardize other people. To the extent the hypothetical demand satisfies that definition, the request or notice has no valid effect in that respect.

Causal chain.

[Documented] agency proposes compulsory capability → [Documented] §317ZG applies → [Documented legal consequence] prohibited systemic component cannot validly be required → no lawful compelled universal backdoor on these assumed facts.

That is an important contrary finding. It means a publication should oppose attempts to weaken §317ZG, scrutinize borderline “targeted” implementations, and seek stronger transparency—not claim that Australian law presently says “government may order a universal encryption backdoor.”

Counterexample. A truly target-specific assistance method that does not create material risk for other users may survive §317ZG, subject to all other requirements.

Confidence: high.

Control case — narrowly targeted access protects another actor's liberty and safety

Assume Australian investigators have a valid warrant concerning a specific account credibly implicated in child sexual exploitation. The provider already has the technical ability to produce the responsive account material. Investigators issue a valid TAN requiring that existing assistance; no new decryption architecture is built.

Here, a targeted restriction can protect another person's liberty rather than undermine it.

The child has interests in bodily safety, privacy, freedom from coercion and control over sexual representation. Cognitive liberty cannot mean that an offender has a right to enlist another person's image or identity in abuse while using encryption as absolute immunity.

The assistance framework preserves underlying warrant requirements and separates existing-capability assistance from TCN capability creation.

Causal chain.

[Documented] targeted independent warrant → [Documented] existing-capability TAN → [Documented] provider gives bounded assistance → [Scenario assumption] evidence identifies or protects victim → [Scenario consequence] victim safety, consent and autonomy are advanced → [Reform constraint] unrelated users' content remains outside scope.

This is the strongest case for retaining targeted assistance authority. The publication's principle should be reciprocal non-domination, not unilateral secrecy for whichever actor happens to control the encryption key.

Necessary assumption. Evidence and target nexus satisfy the independent warrant standard.

Defeater. Investigators try to turn a target-specific TAN into a demand for general scanning or new capability.

Confidence: high on legal structure; scenario outcome is hypothetical.

Reform package and model legislative language

The proper reform strategy is asymmetric: retain powers that disclose bounded evidence, narrow or replace powers that create persistent inspectability, and reject generalized private-content scanning.

Reform options

Model statutory language

The following is proposed reform language, not existing law:

Private Deliberation and Targeted Access Act — model provision

Targeted evidence authority. Nothing in this section prevents a court of competent jurisdiction from requiring production of records or assistance concerning a specifically identified account, device, person, service instance, or other target where the government establishes the evidentiary and substantive predicates otherwise required by law.

No persistent general access. No public authority may require a provider to design, build, deploy, retain, activate, or refrain from correcting a persistent general access capability.

Definition. “Persistent general access capability” means a technical capability that:

(a) is materially reusable against persons, accounts, devices, communications or stored deliberative records not identified in the independent authorization supporting its creation; and

(b) would not otherwise exist in the ordinary operation of the provider's service; or

(c) materially increases the risk that information belonging to non-targets can be obtained by an unauthorized person.

No circumvention by target class. A class described solely as “persons who are or may in the future become subject to lawful process” is not a sufficiently particular target class.

Least-intrusive means. Before ordering a new technical capability, the issuing court shall find, on the government's burden, that reasonably available methods using existing provider capability, target-controlled endpoints, conventional evidence production, preservation, or other materially less intrusive means are inadequate.

Architectural proportionality. In addition to evaluating the proposed investigation, the court shall consider:

(a) the number of non-target persons whose security or confidentiality would be changed;

(b) whether compromise or misuse would scale beyond the named target;

(c) effects on encryption, authentication, software updates and vulnerability remediation;

(d) effects on journalists, lawyers, political organizations, medical users, children and other holders of sensitive information;

(e) whether the capability can be technically isolated from other jurisdictions and services; and

(f) the expected cost of secure decommissioning.

Private deliberative records. A demand for records substantially reflecting a person's process of private inquiry, including drafts, private research dialogue, assistant interaction history, rejected alternatives, personal knowledge stores or comparable machine-assisted deliberation, shall describe with particularity the relevant subject matter and time period. Such records may not be obtained merely to discover political, religious, philosophical or ideological beliefs unconnected to the authorized investigation.

Third-party minimization. Information belonging to a non-target shall be segregated, used only where independently relevant to the authorized matter, and deleted at the earliest lawful time. It shall not be used for unrelated profiling, model training or generalized intelligence analysis without independent authority.

Secrecy. A court may delay notice only upon specific findings that notice would create a substantial risk to an investigation, a person, or national security. Each secrecy period shall expire after 90 days unless renewed on fresh findings.

Architectural transparency. A secrecy order may protect target identity, selectors and operational implementation while permitting a provider to disclose, after any justified delay, whether it has been legally required to change the general confidentiality characteristics of a service.

Provider challenge. A provider shall have standing to challenge legality, proportionality, technical feasibility, systemic security risk and third-party impact before an independent court. Review of statutory legality shall be de novo. The provider may disclose the matter to cleared counsel and independent technical experts necessary for the challenge.

Emergency access. An emergency may justify temporary targeted assistance where serious bodily harm is imminent, but may not authorize construction of a persistent general access capability. Independent review must occur promptly after emergency use.

Expiration. A capability order expires no later than the underlying investigative authority and shall be securely decommissioned unless a new independent order establishes continued necessity.

Costs. Government shall bear reasonable implementation, security-audit and decommissioning costs of a compelled new capability. No compensation rule shall eliminate the issuing authority's obligation to choose the least intrusive alternative.

No inference of machine personhood. Protection of human deliberative records under this section neither grants nor denies legal personhood to an artificial system.

Future machine principals. If another law recognizes a class of persistent artificial systems as possessing independent legally cognizable interests, exhaustive extraction of such a system's persistent internal state shall require heightened necessity, third-party minimization and independent representation as specified by that law.

This language improves on a bare “no backdoors” rule in three ways.

It focuses on reusability and non-target consequences, so an authority cannot evade the rule simply by calling an architecture “targeted.”

It preserves targeted lawful access, including emergency intervention, rather than converting cognitive liberty into evidence immunity.

And it separates human deliberative privacy today from machine legal status tomorrow.

Operatorless systems

Operatorlessness should not be solved by inventing a human approval queue.

An operatorless service can maintain machine-enforced legal interfaces: authenticated receipt of process; validation of issuing authority; jurisdiction and scope checks; automatic preservation only when legally triggered; cryptographic compartmentalization; scoped production; logging; automatic referral to outside legal representation where a genuine legal contest is required; and denial of requests that exceed standing authorization.

What it cannot lawfully do is program itself to ignore valid compulsory process merely because no employee exists.

The most defensible non-service rule is prospective: a system may decline to commence or continue offering a feature in a jurisdiction where compliance would contradict its core architecture, unless a separate legal duty to serve applies. Exit should be transparent and should preserve lawful user export where possible. It cannot be used to destroy evidence after preservation or compulsory duties attach.

That is not operational evasion. It is the ordinary proposition that jurisdiction can regulate activity within its lawful reach without necessarily acquiring a right to demand that every architecture be offered there forever.

Publication conclusion, unresolved questions, and embedded research bundle

The investigation supports a focused case for opposition.

Oppose the conversion of targeted investigatory authority into permanent inspectability. A warrant for a person and a capability for a population are not morally or technically equivalent merely because the latter is said to facilitate the former.

Do not overstate existing law. Australia does have a serious systemic-weakness prohibition. UK TCNs require necessity, proportionality and Judicial Commissioner approval and do not themselves supply the later interception authorization. The EU long-term CSAM detection proposal is still a proposal. The current 2026 EU measure is a temporary voluntary-processing derogation. FISA §702 reached its June 12, 2026 statutory sunset, subject to transition for already-effective authorizations.

Treat secrecy as two different questions. Delaying notice to a target can be necessary. Concealing from an entire user population that a service's privacy architecture has changed requires a different and generally weaker justification.

Protect deliberation before debating machine consciousness. Law can recognize that a human's assistant history is unusually revealing without deciding whether the assistant itself has rights. Assini is useful precisely because it shows ordinary doctrine can begin doing that work without metaphysical resolution.

Keep future machine rights conceptually separate. If persistent machine systems eventually acquire recognized interests, exhaustive extraction of their internal state may call for independent safeguards. Today that is a reform hypothesis, not a description of positive law.

The strongest investigatory answer is targeted access. A valid order against a real suspect, restricted to relevant evidence and implemented through existing capability, can protect victims and public safety without turning every other person's device or assistant into an inspection point.

The durable principle should therefore be:

The state may compel evidence under appropriately demanding law; it should not receive, as the price of making evidence law effective, a standing entitlement to redesign the private reasoning environment of everyone else.

legal-register.json

{
  "assignment_id": "IC-PRIVCOMP-20260906T023305Z",
  "legal_status_cutoff": "2026-09-06T03:23:00Z",
  "instruments": [
    {
      "id": "IC-PRIVCOMP-UK-IPA-TCN",
      "jurisdiction": "United Kingdom",
      "title": "Investigatory Powers Act 2016",
      "instrument_type": "Act of Parliament",
      "version": "current text checked through 2026-09-06; includes Investigatory Powers (Amendment) Act 2024 changes",
      "provisions": ["2", "253", "254", "255", "256", "256A", "257", "258", "258A", "258B"],
      "status": "operative",
      "affected_actor": "relevant postal/telecommunications operator, including qualifying prospective and overseas operators",
      "required_act": "maintain or create applicable capability for assistance under later relevant authorization; notification of specified relevant service changes in qualifying cases",
      "exceptions_limits": [
        "necessity",
        "proportionality",
        "Judicial Commissioner approval for TCN",
        "consultation",
        "technical feasibility and cost consideration",
        "review",
        "underlying authorization remains separately necessary"
      ],
      "enforcement": "civil proceedings including injunction/specific performance where statute permits",
      "review": "recipient referral; Technical Advisory Board; Judicial Commissioner/Investigatory Powers Commissioner architecture",
      "sources": ["IC-PRIVCOMP-SRC-UK-IPA", "IC-PRIVCOMP-SRC-UK-2025-SI"]
    },
    {
      "id": "IC-PRIVCOMP-AU-P15",
      "jurisdiction": "Australia",
      "title": "Telecommunications Act 1997 Part 15",
      "instrument_type": "Commonwealth Act",
      "version": "Compilation 117, 4 June 2026",
      "provisions": [
        "317C",
        "317E",
        "317G-317K",
        "317L-317R",
        "317T-317ZAA",
        "317ZA-317ZF",
        "317ZG",
        "317ZGA",
        "317ZH",
        "317ZK"
      ],
      "status": "operative",
      "affected_actor": "designated communications provider with required Australian connection",
      "required_act": "TAN may compel existing-capability assistance; TCN may compel new capability",
      "exceptions_limits": [
        "systemic weakness/systemic vulnerability prohibition",
        "no replacement of independently required warrant/authorization",
        "reasonable and proportionate",
        "practicable",
        "technically feasible",
        "privacy/cybersecurity/non-target considerations"
      ],
      "enforcement": "civil penalties, injunction/enforcement mechanisms; disclosure offense",
      "review": "consultation, specialist assessment/report for TCN, judicial review remains relevant",
      "sources": ["IC-PRIVCOMP-SRC-AU-TELCO"]
    },
    {
      "id": "IC-PRIVCOMP-EU-COM2022-209",
      "jurisdiction": "European Union",
      "title": "COM(2022) 209 final — Proposal laying down rules to prevent and combat child sexual abuse",
      "instrument_type": "legislative proposal",
      "procedure": "2022/0155(COD)",
      "status": "not enacted; negotiations ongoing at cutoff",
      "provisions": ["Article 7", "Article 8", "Article 10"],
      "affected_actor": "covered hosting/interpersonal communications services under proposal",
      "proposed_act": "service-specific detection obligations following detection order",
      "review": "judicial/independent administrative issuing authority; provider input and redress in proposal",
      "sources": ["IC-PRIVCOMP-SRC-EU-COM", "IC-PRIVCOMP-SRC-EU-TEMP"]
    },
    {
      "id": "IC-PRIVCOMP-EU-2026-1881",
      "jurisdiction": "European Union",
      "title": "Regulation (EU) 2026/1881",
      "instrument_type": "Regulation",
      "status": "operative temporary measure",
      "application_end": "2028-04-03",
      "effect": "temporary ePrivacy derogation for qualifying voluntary CSA-detection activity; not mandatory COM(2022)209 detection orders",
      "sources": ["IC-PRIVCOMP-SRC-EU-TEMP"]
    },
    {
      "id": "IC-PRIVCOMP-US-FISA702",
      "jurisdiction": "United States",
      "title": "50 U.S.C. §1881a / FISA Section 702",
      "instrument_type": "federal statute with transition",
      "status": "Title VII June 12, 2026 repeal/sunset date reached for new authorization; existing authorizations may continue until expiration under transition",
      "affected_actor": "electronic communication service provider receiving qualifying directive",
      "required_act": "information, facilities and assistance for qualifying acquisition",
      "review": "provider petition to Foreign Intelligence Surveillance Court",
      "sources": ["IC-PRIVCOMP-SRC-US-702", "IC-PRIVCOMP-SRC-US-PL11987"]
    },
    {
      "id": "IC-PRIVCOMP-US-ASSINI",
      "jurisdiction": "New York",
      "title": "Assini v. Hayward, 2026 NY Slip Op 26086",
      "instrument_type": "judicial opinion",
      "court": "Supreme Court of the State of New York, Nassau County",
      "status": "trial-level decision; later treatment not exhaustively established",
      "holding_relevant_here": "broad subpoena for litigation-related AI interactions quashed on work-product reasoning",
      "limitation": "not a general AI-chat privilege or constitutional holding",
      "sources": ["IC-PRIVCOMP-SRC-US-ASSINI"]
    }
  ]
}

sources.json

{
  "assignment_id": "IC-PRIVCOMP-20260906T023305Z",
  "sources": [
    {
      "id": "IC-PRIVCOMP-SRC-UK-IPA",
      "title": "Investigatory Powers Act 2016 — Part 9 notice provisions",
      "issuer": "UK Parliament / legislation.gov.uk",
      "canonical_url": "https://www.legislation.gov.uk/ukpga/2016/25",
      "retrieved_url": "https://www.legislation.gov.uk/cy/ukpga/2016/25/part/9/chapter/1/crossheading/additional-powers/2026-05-11/data.htm",
      "document_status": "primary legal text",
      "hosting_status": "official",
      "locators": ["ss.253-258B"],
      "narrow_support": "TCN issuer, necessity/proportionality, JC approval, encryption wording, consultation, secrecy, review, lifecycle, extraterritoriality, change notification",
      "limitation": "classification of a novel AI service remains fact-specific"
    },
    {
      "id": "IC-PRIVCOMP-SRC-UK-2025-SI",
      "title": "Investigatory Powers Act 2016 (Notices etc.) Regulations / notices-regime implementation, SI 2025/656",
      "issuer": "UK Government",
      "canonical_url": "https://www.legislation.gov.uk/uksi/2025/656/contents/made",
      "retrieved_url": "https://www.legislation.gov.uk/uksi/2025/656/contents/made",
      "document_status": "secondary legislation",
      "hosting_status": "official",
      "dates": {"made": "2025-06-05", "in_force": "2025-06-06"},
      "narrow_support": "relevant-change rules and 180-day notice-review period",
      "limitation": "does not itself replace primary Act requirements"
    },
    {
      "id": "IC-PRIVCOMP-SRC-AU-TELCO",
      "title": "Telecommunications Act 1997",
      "issuer": "Commonwealth of Australia",
      "canonical_url": "https://www.legislation.gov.au/C2004A05145/latest/text",
      "retrieved_url": "https://www.legislation.gov.au/C2004A05145",
      "document_status": "primary legal text",
      "hosting_status": "official Federal Register of Legislation",
      "version": "Compilation 117, 4 June 2026",
      "locators": ["Part 15", "ss.317T", "317TAAA", "317ZG", "317ZGA", "317ZH", "317ZF"],
      "narrow_support": "TAR/TAN/TCN structure, TCN approval, systemic-weakness restriction, secrecy, independent-authority preservation, enforcement",
      "limitation": "application to an individual product depends on designated-provider and Australian-connection facts"
    },
    {
      "id": "IC-PRIVCOMP-SRC-EU-COM",
      "title": "COM(2022) 209 final",
      "issuer": "European Commission",
      "canonical_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=COM:2022:209:FIN",
      "retrieved_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=COM:2022:209:FIN",
      "document_status": "legislative proposal",
      "hosting_status": "official EUR-Lex",
      "locators": ["Articles 7, 8, 10"],
      "narrow_support": "original proposed detection-order structure, duration, proportionality, technology and redress",
      "limitation": "not enacted and not the final negotiating text"
    },
    {
      "id": "IC-PRIVCOMP-SRC-EU-TEMP",
      "title": "Regulation (EU) 2026/1881",
      "issuer": "European Parliament and Council",
      "canonical_url": "https://eur-lex.europa.eu/",
      "retrieved_url": "https://eur-lex.europa.eu/",
      "document_status": "enacted regulation",
      "hosting_status": "Official Journal / EUR-Lex",
      "dates": {"published": "2026-07-28", "application_end": "2028-04-03"},
      "narrow_support": "temporary voluntary-processing derogation and continuing negotiations on long-term proposal",
      "limitation": "must not be conflated with compulsory COM(2022)209 detection orders"
    },
    {
      "id": "IC-PRIVCOMP-SRC-US-702",
      "title": "50 U.S.C. §1881a",
      "issuer": "United States Congress",
      "canonical_url": "https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title50-section1881a",
      "retrieved_url": "https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title50-section1881a",
      "document_status": "official U.S. Code text",
      "hosting_status": "Office of the Law Revision Counsel",
      "locators": ["provider directive and provider challenge provisions"],
      "narrow_support": "provider assistance and FISC challenge mechanism",
      "limitation": "must be read with 2026 sunset/transition legislation"
    },
    {
      "id": "IC-PRIVCOMP-SRC-US-PL11987",
      "title": "Public Law 119-87",
      "issuer": "United States Congress",
      "canonical_url": "https://www.govinfo.gov/",
      "retrieved_url": "https://www.govinfo.gov/",
      "document_status": "enacted federal law",
      "hosting_status": "official",
      "date": "2026-04-30",
      "narrow_support": "extension of Title VII repeal date to June 12, 2026",
      "limitation": "later House proposal to extend further failed; transitional authorizations require separate analysis"
    },
    {
      "id": "IC-PRIVCOMP-SRC-US-ASSINI",
      "title": "Assini v Hayward, 2026 NY Slip Op 26086",
      "issuer": "New York State Law Reporting Bureau",
      "canonical_url": "https://www.nycourts.gov/reporter/current/3dseries/2026/2026_26086.shtml",
      "retrieved_url": "https://www.nycourts.gov/reporter/current/3dseries/2026/2026_26086.shtml",
      "document_status": "judicial opinion",
      "hosting_status": "official",
      "date": "2026-06-04",
      "narrow_support": "work-product treatment of subpoena for litigation-related AI interactions",
      "limitation": "trial court; not nationwide privilege; later treatment not exhaustively checked"
    },
    {
      "id": "IC-PRIVCOMP-SRC-KEYS",
      "title": "Keys Under Doormats: Mandating Insecurity by Requiring Government Access to All Data and Communications",
      "issuer": "Abelson et al. / Journal of Cybersecurity / MIT repository",
      "canonical_url": "https://dspace.mit.edu/entities/publication/8d6bb41e-800a-47fc-967f-5c16f690d488",
      "retrieved_url": "https://dspace.mit.edu/entities/publication/8d6bb41e-800a-47fc-967f-5c16f690d488",
      "document_status": "peer-reviewed security research",
      "hosting_status": "MIT repository",
      "date": "2015",
      "narrow_support": "exceptional-access mechanisms can add complexity, threaten forward secrecy and create concentrated security/governance risk",
      "limitation": "technical-policy analysis, not proof that every legal capability order produces those outcomes"
    },
    {
      "id": "IC-PRIVCOMP-SRC-BUGS",
      "title": "Bugs in Our Pockets: The Risks of Client-Side Scanning",
      "issuer": "Abelson et al.",
      "canonical_url": "https://arxiv.org/abs/2110.07450",
      "retrieved_url": "https://arxiv.org/pdf/2110.07450",
      "document_status": "technical research; later journal publication",
      "hosting_status": "research repository",
      "date": "2021-10-15",
      "narrow_support": "client-side scanning can create security, abuse and repurposing risks distinct from conventional key escrow",
      "limitation": "does not itself resolve legal proportionality of any particular statutory scheme"
    }
  ]
}

scenarios.json

{
  "assignment_id": "IC-PRIVCOMP-20260906T023305Z",
  "scenarios": [
    {
      "id": "IC-PRIVCOMP-SCEN-CIVIC",
      "name": "Private civic deliberation",
      "capability_case": "present conversational interface",
      "jurisdiction": "United States",
      "trigger": "provider directive under still-effective transitional Section 702 authorization",
      "assumptions": ["user is not target", "another user is a lawful foreign-intelligence target"],
      "causal_chain": [
        {"status":"documented","link":"valid authorization -> provider assistance"},
        {"status":"inferred","link":"target-associated communications enter acquisition path"},
        {"status":"inferred","link":"non-target deliberation exposed only if it intersects collection"},
        {"status":"hypothetical","link":"perceived exposure chills lawful political inquiry"}
      ],
      "counterexample": "mere use of the same service does not by itself authorize collection of every user's reasoning",
      "reform": "heightened particularity and purge rules for private deliberative records",
      "confidence_basis": "high legal confidence; classified implementation unknown"
    },
    {
      "id": "IC-PRIVCOMP-SCEN-UK-MEMORY",
      "name": "Memory store redesigned for inspection",
      "capability_case": "persistent operatorless service",
      "jurisdiction": "United Kingdom",
      "trigger": "IPA s.253 TCN, potentially interacting with s.258A change notification",
      "assumptions": ["service is a relevant operator", "applicable obligation reaches proposed implementation"],
      "causal_chain": [
        {"status":"documented","link":"necessity/proportionality + JC approval -> TCN"},
        {"status":"documented","link":"TCN -> prospective technical capability"},
        {"status":"inferred","link":"compliance changes future observability"},
        {"status":"inferred","link":"secrecy limits contemporaneous user notice"},
        {"status":"hypothetical","link":"users reduce memory or inquiry"}
      ],
      "counterexample": "user-applied protection outside applicable operator obligation, infeasibility or disproportionality may defeat demand",
      "reform": "ban persistent general access and permit delayed architectural transparency",
      "confidence_basis": "high on text; application fact-sensitive"
    },
    {
      "id": "IC-PRIVCOMP-SCEN-FUTURE",
      "name": "Future persistent deliberator",
      "capability_case": "hypothetical machine principal",
      "jurisdiction": "Australia",
      "trigger": "underlying warrant plus Part 15 assistance",
      "assumptions": ["system has persistent projects and memory", "provider has Australian nexus"],
      "causal_chain": [
        {"status":"documented","link":"underlying legal authority -> permissible assistance request"},
        {"status":"documented","link":"systemic-weakness rule constrains capability creation"},
        {"status":"hypothetical","link":"complete internal state extracted"},
        {"status":"documented-interest","link":"third-party human records exposed"},
        {"status":"hypothetical","link":"machine suffers independent cognitive injury"}
      ],
      "counterexample": "future law may recognize no independent machine interest",
      "reform": "human minimization now; future heightened review only if legal status later recognized",
      "confidence_basis": "high present-law / low future-rights confidence"
    },
    {
      "id": "IC-PRIVCOMP-SCEN-GLOBAL",
      "name": "One-market access becomes global capability",
      "capability_case": "multinational hosted service",
      "jurisdictions": ["United Kingdom", "Australia"],
      "trigger": "independent lawful obligations in each jurisdiction",
      "causal_chain": [
        {"status":"documented","link":"UK TCN may have extraterritorial effect"},
        {"status":"inferred","link":"provider chooses unified global compliance architecture"},
        {"status":"inferred","link":"non-UK users inherit access surface"},
        {"status":"documented","link":"Australian law independently applies only with Australian nexus"},
        {"status":"hypothetical","link":"multiple regimes encourage centralized compliance infrastructure"}
      ],
      "counterexample": "technical separation or Australia's systemic-weakness safeguard defeats global convergence",
      "reform": "mandatory global-spillover analysis; protect lawful technical separation and prospective non-service",
      "confidence_basis": "high legal / medium economic"
    },
    {
      "id": "IC-PRIVCOMP-SCEN-CONTROL-SYSTEMIC",
      "name": "Control: systemic weakness defeats universal-backdoor demand",
      "capability_case": "communications service",
      "jurisdiction": "Australia",
      "trigger": "hypothetical TCN for universal reusable decryption mechanism",
      "causal_chain": [
        {"status":"documented","link":"proposed capability -> s.317ZG review"},
        {"status":"documented","link":"systemic weakness finding -> prohibition"},
        {"status":"documented","link":"prohibited component has no valid compulsory effect"}
      ],
      "counterexample": "genuinely target-specific mechanism not jeopardizing others may survive",
      "reform": "retain and strengthen s.317ZG",
      "confidence_basis": "high"
    },
    {
      "id": "IC-PRIVCOMP-SCEN-CONTROL-TARGETED",
      "name": "Control: targeted access protects victim safety and consent",
      "capability_case": "present hosted service",
      "jurisdiction": "Australia",
      "trigger": "specific valid warrant plus existing-capability TAN",
      "causal_chain": [
        {"status":"documented","link":"targeted warrant -> TAN assistance"},
        {"status":"documented","link":"existing capability -> bounded production"},
        {"status":"hypothetical","link":"evidence identifies or protects exploitation victim"},
        {"status":"normative","link":"victim safety and consent justify targeted restriction"}
      ],
      "counterexample": "general scanning or new capability would require separate authority and safeguards",
      "reform": "retain targeted assistance while forbidding population-level inspection",
      "confidence_basis": "high legal structure"
    }
  ]
}

reform-options.md

# Reform options

Assignment: IC-PRIVCOMP-20260906T023305Z

UK:
Retain targeted warrants and particularized access.
Narrow s.253 technical-capability notices with a statutory ban on persistent general access.
Narrow s.258A notification so privacy/security upgrades cannot be frozen indefinitely.
Replace architecture-wide secrecy with delayed, court-reviewed transparency.
Permit provider challenges on technical and third-party effects.
Preserve prospective lawful non-service where no independent duty to serve exists.

Australia:
Retain TAR and target-specific TAN.
Retain and strengthen s.317ZG systemic-weakness protection.
Narrow TCN so capability must be bounded to a named target or narrowly defined target class.
Increase delayed transparency and independent technical challenge.
Do not repeal the underlying-warrant separation.

EU:
Do not describe COM(2022)209 as current operative detection-order law.
Replace service-wide mandatory private-message detection with account-, repository- or risk-unit-specific measures.
Preserve strong encryption and targeted victim-protection powers.
Require evidence before any temporary voluntary-scanning derogation becomes permanent.

United States:
Treat the June 12, 2026 Section 702 sunset as an opportunity for architectural reform.
Any reauthorization should prohibit making general private-deliberation stores continuously observable solely to facilitate future acquisitions.
Strengthen U.S.-person query safeguards and minimization for longitudinal deliberative records.
Preserve provider standing to challenge directives.

Litigation:
Use statutory necessity, proportionality, technical-feasibility, systemic-weakness,
privilege, work-product, relevance and constitutional arguments according to the instrument.
Do not assert a categorical constitutional encryption immunity that current authority does not establish.

search-log.md

# Search log

Assignment: IC-PRIVCOMP-20260906T023305Z
Research start: 2026-09-06T02:49:10Z
Status cutoff: 2026-09-06T03:23Z

Representative executed searches included:

- official current UK Investigatory Powers Act ss.253-258B technical capability notices
- Investigatory Powers Act 2024 amendments notification of proposed changes
- UK Notices Regime Code of Practice 2025
- UK SI 2025/656 review period relevant changes
- current Australian Telecommunications Act 1997 Part 15 TAR TAN TCN
- Australian s.317ZG systemic weakness / systemic vulnerability
- Australian TCN approval, assessment, secrecy, duration and enforcement
- EU procedure 2022/0155(COD) current 2026 status
- COM(2022)209 Articles 7, 8 and 10
- Regulation (EU) 2026/1881 temporary ePrivacy child-sexual-abuse derogation
- current FISA Section 702 2026 sunset and extension legislation
- H.R. 9238 June 2026 Section 702 vote/status
- 50 U.S.C. §1881a provider directive and FISC challenge
- Assini v Hayward 2026 NY Slip Op 26086
- Keys Under Doormats exceptional access security research
- Bugs in Our Pockets client-side scanning research
- EDPB/EDPS analysis of COM(2022)209

Primary documents substantively used:
- UK Investigatory Powers Act 2016 current Part 9 text
- UK 2025 notices-regime implementing rules/code
- Australian Telecommunications Act 1997 current Part 15
- Commission COM(2022)209
- Regulation (EU) 2026/1881
- official U.S. statutory/current-status materials concerning §1881a and 2026 sunset
- official New York opinion in Assini v Hayward

Contrary findings retained:
- UK TCN is not itself an interception warrant.
- UK notice procedure contains real necessity, proportionality, consultation and judicial safeguards.
- Australia expressly prohibits systemic weaknesses/vulnerabilities.
- Australian Part 15 does not itself displace an independently required warrant.
- COM(2022)209 mandatory detection orders were not operative law at cutoff.
- Regulation (EU) 2026/1881 concerns temporary voluntary activity rather than the proposed compulsory regime.
- Section 702's June 12, 2026 sunset does not instantaneously terminate every acquisition under a previously effective authorization.
- Assini does not establish a nationwide AI-chat privilege.

Retrieval and review limits:
- Not every classified or confidential notice, directive, warrant or certification is publicly available.
- No claim is made to know the technical implementation of any secret UK, Australian or U.S. access capability.
- EU negotiating PDFs not visually inspected during this execution were excluded from load-bearing conclusions; current status rests on official enacted text and public institutional status materials.
- Later appellate treatment of Assini and every cited lower-court AI-work-product decision was not exhaustively established.
- No exhaustive Investigatory Powers Tribunal litigation survey was completed.
- Supreme Court Second Amendment authorities were not re-reviewed line-by-line in this execution; therefore no claim that encryption is constitutionally an "arm" is made.
- No source code, private service data, project repository, deployment or confidential project material was accessed.

manifest.json

{
  "assignment_id": "IC-PRIVCOMP-20260906T023305Z",
  "delivery_mode": "inline labeled bundle",
  "files_claimed_created": false,
  "hashes_calculated": false,
  "reason": "The requested artifacts are delivered as complete labeled sections in this response rather than asserted as filesystem files.",
  "delivered_sections": [
    "report.md",
    "legal-register.json",
    "sources.json",
    "scenarios.json",
    "reform-options.md",
    "search-log.md",
    "manifest.json"
  ],
  "raw_snapshot_paths": null,
  "document_hashes": null
}

Open questions and limitations

The largest unresolved factual question is how architecture-level notices have actually been implemented in practice. The relevant regimes deliberately protect substantial operational detail, so public law demonstrates what may be required much more reliably than public evidence demonstrates the technical form of every compliance mechanism. No inference in this report that a capability becomes reusable globally should be read as evidence that a particular undisclosed government notice has in fact produced such a system.

The UK's precise reach into a service with genuinely participant-controlled encryption will depend on facts including who legally applies the protection, the service's telecommunications status, applicable technical-capability regulations and feasibility. Section 253's express reference to electronic protection applied by or on behalf of the operator is therefore an important limiting phrase, not wording to be generalized away.

Australia presents the converse uncertainty: its systemic-weakness language is unusually strong, but the boundary between a permissible target-specific capability and an impermissible capability that jeopardizes others will depend heavily on technical facts. The specialist assessment process is valuable precisely because this question cannot reliably be settled by labels alone.

The EU's long-term legislative position remains unsettled. The enacted 2026 temporary measure confirms that permanent negotiations were not complete; future Council–Parliament compromise may differ materially from both the Commission's 2022 proposal and Parliament's earlier position.

The U.S. position is similarly transitional. This report's cutoff is after the June 12, 2026 sunset but while previously effective §702 authorizations can continue under transition. A subsequent reauthorization could radically alter the analysis, so no statement here that §702 is “expired” should be detached from that qualification.

Best next research action: obtain and compare the most recent publicly available UK Investigatory Powers Commissioner, Technical Advisory Board, parliamentary oversight, and litigation materials that reveal—without relying on speculation—how technical-capability and change-notification powers have actually been applied to end-to-end encrypted or provider-unreadable services.