The reason encryption stopped being an argument for most people is that nobody had to opt in. Signal, WhatsApp and Apple's iMessage pushed end-to-end encryption out to everyone at once, and Apple began encrypting device data by default, so a strong PIN was enough to keep an iPhone shut [4]. Users do not weigh a security setting the way a product team imagines; they inherit whatever ships as the default. A mandate is aimed at that inheritance, which is why the part of your product it touches is the configuration you ship to people who never open the privacy screen.
Green's case runs through supply rather than policy. He wrote that he is worried AI will make software much too secure, leaving the US government without flaws to use against targets it needs to surveil as vendors patch at volume [2]. Bugs are the currency of what he calls an uneasy truce, in which governments spent money on hacking tools and spyware instead of requiring backdoors [5], and his conclusion is that scarcity brings the backdoor request back [6]. The premise underneath is that LLMs are getting better and faster at finding vulnerabilities at scale, which proponents promise and some early data suggests [15].
That premise is the weak plank. The canvass TechCrunch ran produced one quantity: Hamid Kashfi of DarkCell, who also works at the AI security startup Xbow, estimates that for every AI-found bug reported there are probably 20 that are not [11]. Read literally, reported findings are roughly 5% of what AI turns up, one in twenty-one [13], which points away from Green rather than toward him, because a hidden discovery boom does not produce patched software. Count the practitioners quoted and four disagreed with Green against two who agreed [12]. Crowdfense's Paolo Stagno sits between them, calling the requirement that governments burn an exploit the most democratic system available while saying plainly that no state will throw away surveillance [9].
So the thing being pitched is AI-hardened software, and the thing being decided is where recoverable copies of user content live and who can be served an order for them. Two questions sort that. Can you produce a named user's content today without their device or passphrase? Would gaining that ability require new client code shipped through app store review?
If you already hold enough to be served, the answer to both is yes: you are the cheapest fallback already, and your request volume grows without any new law, though you also pay twice, since you can be asked but cannot comply quickly. If you hold nothing today, the answer to both is no, and that is where a mandate would actually change something, because escrow could be added server-side without users ever seeing it, which is exactly the capability a statute would name. The one version of this that gets argued in public rather than settled in a legal inbox is the case where compliance shows up in a release note.
The useful exercise is not forecasting bug supply, which the people who trade in bugs do not agree on [14]. It is writing the paragraph that answers what you would ship within 90 days if your largest market mandated access, and naming who signs it. A team that can write that paragraph is still choosing its own architecture. A team that cannot will implement whatever design the drafters had in mind.
