On Monday, November 9, France's digital minister Anne Le Hénanff stood up in the National Assembly and made two promises. The government will not force messaging apps to build a backdoor into your encrypted conversations, at least not until the end of the parliamentary session. And the government will support removing Article 16 bis, the clause the Senate wrote to ban that kind of access in law.

Read those two promises together and the second one eats the first. A government that promises not to do something for a few months, while also asking to delete the law that would stop it doing that thing permanently, has not changed its mind. It has changed its timetable.

I build encrypted messengers. I have spent the last year writing one from scratch, including a post-quantum key exchange, and the first decision you make in that kind of project is who holds the keys. Everything else follows from it. So when a government talks about "targeted access to protected content" that somehow does not weaken encryption, I know exactly what that sentence is worth. It is worth nothing, because the thing it describes does not exist.

How France got here

This fight did not start last week. It started with the 2025 narcotrafficking law, when a Senate amendment, backed at the time by the government itself, tried to force WhatsApp, Signal, Telegram, Messenger and the French app Olvid to hand over the messages of people under surveillance, even when those messages were encrypted. The publishers pushed back hard, and the deputies in the National Assembly removed the measure.

The senators answered by writing the opposite into the resilience bill: a ban on backdoors, locked into law as Article 16 bis. The resilience bill itself has been dragging on for over a year. It was voted in committee in September 2025 and mostly exists to transpose three European directives, including NIS2, the EU's big network security project. France is now being taken to the European Court of Justice over the delay. The head of ANSSI, the agency that defends the state against cyberattacks, has pointed out that these measures would have prevented a good part of the data thefts the French administration suffered in recent months.

Encryption was the stumbling block holding the whole bill up. In January, a mission was handed to deputy Florent Boudie, three months in theory. It took him eight. His report, delivered this year, advises abandoning backdoors and removing Article 16 bis, while at the same time asking the state to work on "targeted access to protected content" that would not weaken encryption.

That last phrase is doing a lot of work, and it is the phrase I want to spend the rest of this article on, because it is the phrase that will come back in every country, in every parliament, for the next ten years.

There is no door that only opens for the right people

Here is the problem, stated plainly. In a genuinely end-to-end encrypted messenger, the keys live on the two phones in the conversation. The server in the middle moves ciphertext it cannot read. That is the whole design. It is not a feature you can keep while adding a third reader, because the third reader needs a key, and a key that exists can be stolen, copied, leaked, or demanded by someone else.

Cryptographers have been explaining this for years, and the head of Olvid has been leading that argument in France. There is no "magic access reserved for the authorities." A backdoor is a vulnerability with a permission slip attached. Once the code exists that lets a third party read messages, that code is in the product. It can be found by researchers, by criminals, by another government. The idea that you can build it so carefully that only French investigators can use it is not engineering, it is wishful thinking dressed up as a compromise.

I learned this the practical way. When I was building my own messenger, I had to decide where the identity keys live and what the server is allowed to see. The moment you give the server a way to read messages "just in case," you have not built an encrypted messenger with an exception. You have built a cloud chat app with encryption marketing. The users cannot tell the difference from the outside. The code can. And an attacker who finds that code path does not care what the law said it was for.

That is why Signal's president Meredith Whittaker has said she would rather see her app leave France than slip in the slightest access. It sounds dramatic until you understand the engineering: there is no slightest access. There is access, or there is not.

The appetite has not gone away

The reason to be skeptical of the promise is not just the engineering. It is the demand side. The head of the DGSI, France's domestic intelligence service, spoke in September 2025 about the "programmed blindness" of her services. The CNCTR, the authority that oversees these surveillance techniques, notes that requests to break into phones have more than doubled in four years, to the point of becoming almost automatic.

A government with that appetite, that has just been handed a report recommending the ban be removed, and that promises restraint only until the end of the current session, is a government keeping its options open. The promise costs nothing. The ban would have cost something. Guess which one they chose to keep.

This pattern is worth naming because it is not unique to France. A legislature tries the direct route, forcing access by law. The tech community and the public push back. The government retreats, but instead of accepting the defeat it asks for the protective law to be removed, promises good behavior for a while, and commissions work on a softer-sounding alternative. "Targeted access" is the new phrase. The UK tried "ghost participants" a few years ago, the idea of silently adding a government listener to a group chat. The EU has debated client-side scanning. The names change. The demand stays the same: a way in that does not count as a backdoor.

What a builder should take from this

If you build messaging software, or you choose which messenger to trust, there are three practical lessons in this story.

First, judge a government by the laws it keeps, not the promises it makes. A promise lasts until the end of a session. A ban written into law lasts until someone repeals it, in public, with a vote. When a minister offers you a promise and asks to delete the law in the same breath, believe the deletion, not the promise.

Second, treat any proposal for "access that does not weaken encryption" as a backdoor until someone shows you the design. Not the press release, the design. Which keys exist, where do they live, who holds them, what happens when they leak. If nobody can answer those questions, the proposal is not a technical solution, it is a political sentence designed to sound like one.

Third, remember that the fight is never really over. Boudie's mission took eight months and produced a recommendation to remove the protection. The bill still has to pass. The next session will bring a new chance to reintroduce the demand. The people who build and use encrypted messengers have to keep showing up, because the people who want a way in certainly will.

France did not backdoor your messages this week. That is genuinely good news, and it happened because publishers, cryptographers and users pushed back hard enough to make the direct route politically expensive. But the government also asked to remove the law that would have made the victory permanent, and it did so while promising nothing beyond a few months. A win that comes with an expiry date is not a win. It is a pause.

And pauses end.

Sources: Korben, "Backdoors in your encrypted messaging apps", reporting on the resilience bill debate of November 9, 2026, and Nikopik's original French coverage.