Cyber Insights 2026: Regulations and the Tangled Mess of Compliance Requirements

By Kevin Townsend for SecurityWeek
Friday, January 23, 2026

• 316
• More

Governments have been demanding insertion of and access to backdoors into E2EE services for several years. The argument is LEA access to encrypted messages is necessary for national security and the prevention of serious crime. Most technologists dislike the concept, believing that any backdoor will inevitably reach the hands of bad actors.

Ilia Kolochenko, CEO at Immuniweb, and cybersecurity partner at Platt Law, takes a pragmatic view.

“It is unlikely that countries will pass laws requiring mandatory backdoors, since most vendors would simply leave the market, and the country would revert to the Middle Ages. Instead of backdoors, law enforcement should use the currently available techniques of lawful hacking, cost-efficient bugging techniques, and time-tested oppressive interrogations to make suspects give up their passcodes. In most cases, including serious crime, this works fairly well,” he says.

But he also points out that while backdoors would simply make life easier for law enforcement, the lack of them won’t protect people if law enforcement really wants to get the data.

Kolochenko believes AI will create problems for governments. “Gen-AI currently cannot be effectively censored,” he says, “…but it can and does spread a lot of harmful, illicit and dangerous materials.”

This can, and already does, include the mass dissemination of disinformation by bots, aiming to cause social disarray and potential regime change.

The problem is similar to the use of E2EE – once available and distributed it is very hard to control. Governments have attempted to persuade the manufacturers to insert controls at source, and Kolochenko sees a potentially similar approach to regulating AI: “A de facto monopolization of governmental control over AI vendors, ensuring that no chatbot will ever do something that is prohibited by local law or unwritten custom.”

Agentic AI will be problematic. It is designed to be autonomous, to make its own decisions, and eventually to automatically carry out those decisions without human intervention. But the developers of agentic systems don’t always know when it connects with which internal or external data sources; and agentic systems could, potentially, change themselves. Read Full Article