The ghost participant attack, or how to break E2E encryption structurally

Mr. Latte ∙ Software Development Expert

France’s parliamentary intelligence oversight body, the Délégation parlementaire au renseignement (DPR), is made up of four senators and four deputies. According to recent reporting, it examined a so-called “ghost participant” approach that would let investigators reach into encrypted messengers such as WhatsApp, Signal and Telegram. The idea is to add law enforcement as an extra recipient without the people in the conversation noticing.

The full report and the concrete technical design are not publicly available yet. What follows should therefore be read against the reporting that exists.

A ghost participant does not break the cryptography. It manipulates the process that decides who takes part in a conversation. The encryption operations keep working exactly as designed, and the message is encrypted to a recipient the user never chose. Instead of attacking the math, it changes the trust model.

What end-to-end encryption actually guarantees

The point of end-to-end encryption is that only the sender and the intended recipient can read plaintext. The server relays ciphertext and, in principle, holds no key that would decrypt it.

Modern messengers like Signal do not simply encrypt every message to one long-term public key. They combine an initial key agreement, session key derivation and per-message key ratcheting to provide properties such as forward secrecy and post-compromise recovery. The protocols are intricate, but the security guarantees summarize cleanly.

1. Each user’s device generates and stores its encryption keys.
2. The server relays public key material and encrypted messages.
3. The sender establishes sessions targeting verified recipient devices.
4. Only the recipient’s device decrypts a given message.
5. When participants or devices change, the user must be able to see it.

That last condition carries more weight than it looks. End-to-end encryption is not finished by the cipher alone. Users have to know precisely who they are talking to. If a server can quietly rewrite the participant list or the key material, no amount of algorithmic strength establishes who is on the other end.

How a ghost participant dismantles the guarantee

Implementing a ghost participant requires the platform to add a law enforcement device or key to the conversation. It also requires suppressing the “a new device was added” or “group membership changed” notice that existing participants would otherwise see.

The messages are still encrypted correctly. The problem is that the user does not know the recipient set has changed.

Normal state
Alice ──encrypt──> Bob

With a ghost participant
Alice ──encrypt──> Bob
      └─encrypt──> law enforcement

Under this design the platform never has to decrypt ciphertext itself. It is enough to make the sender’s client produce one additional ciphertext for the agency. The user believes the message went to Bob alone, while the client encrypts and transmits it to another recipient as well.

A ghost participant is therefore not a weakness in the cipher. It is an exceptional-access feature bolted onto the authentication and membership layer. One more “end” appears in end-to-end encryption, and the user had no say in it.

Not the same as key escrow, but the risk rhymes

Ghost participants, key escrow and master keys are technically distinct.

Key escrow puts a decryption key, or the means to recover one, in a third party’s custody. A master key scheme uses one privileged key to reach many users’ data. A ghost participant instead adds the agency as a separate recipient so that messages reach it from the start.

All three share something that matters more than the differences. Each requires the service provider to operate a privileged path that grants a third party access without the user’s knowledge. That path needs order approval, target identification, key registration, client behavior changes, audit logging and access control. All of it becomes new attack surface.

An insider can abuse the feature. An attacker can steal the agency’s credentials. An authoritarian government can demand the same capability, and the legal scope can widen over time. The moment lawful access is implemented in code, a second security problem appears: guaranteeing who may use that power, and under what conditions.

Why an old argument keeps coming back

The best-known attempt to reach encrypted communications through government-held recovery keys was the Clipper Chip in the 1990s United States. In a 1994 analysis, Matt Blaze showed that the device’s escrow enforcement mechanism could be circumvented. An access scheme built for government use alone still ends up as an object of analysis and attack.

Keys Under Doormats, published in 2015, made the parallel warning for modern systems: mandating exceptional access raises complexity and attack surface, and turns large-scale key management and authentication infrastructure into a high-value target.

A ghost participant does avoid part of the classic escrow problem, since no decryption key is centrally held. But the set of things a user must trust grows rather than shrinks. Is the platform displaying the participant list honestly? Was the agency key registered lawfully? Was the access capability used only on approved cases? All three have to hold.

Network interception does not get you the same result

Implementing ghost participants at the platform and intercepting traffic on the network are different things, and it helps to keep them apart.

When end-to-end encryption is implemented correctly and the peer’s key is verified, deep packet inspection or DNS redirection alone will not reveal message content. A network operator can observe metadata such as which service was contacted, when, and how much data moved, and can block a service outright. Turning ciphertext into plaintext is not on that list.

Reading content at the network level requires tricking the client into accepting a forged key, or compromising the user’s device or the authentication infrastructure. The problem lands back on endpoints and key distribution.

Ordinary users are exposed more than criminals

Exceptional access carries a stark asymmetry. Ordinary users take the app and the key distribution system the platform gives them. If the server is designed to add participants or devices silently, they have little practical way to verify otherwise.

Organized crime groups, meanwhile, can modify open protocols, run their own servers and add independent key verification steps. They can abandon the commercial messengers the access mandate covers and move somewhere else.

The result is that exceptional access weakens communications for the rule-following majority while pushing the highest-value investigative targets toward other tools. In 2025 the French National Assembly removed the encrypted-messaging access provision from its narcotics enforcement bill. Opponents argued at the time that the feature would lower security for all users and drive criminals to other tools (Assembly proceedings, EFF analysis).

Signal has repeatedly said it would leave a market rather than accept a demand that compromises encryption integrity. That is not merely a negotiating posture. Implementing ghost participants would require deliberately rewriting the security model that shows membership changes transparently.

The debate at EU level

In 2025 the European Commission published ProtectEU, its internal security strategy. It includes strengthening lawful data access capabilities for law enforcement and preparing a technology roadmap on the impact of encryption on investigations.

Describing this as “the EU has officially adopted encryption backdoors” would be inaccurate. The current stage is closer to policy work examining access methods and the technical and legal conditions around them. What is clear is that exceptional access to encrypted communications is now on the formal EU agenda.

Any serious discussion has to answer at least these questions.

• Who controls the authority to let a platform add recipients silently?
• What happens to the user’s ability to verify participant and device lists?
• If an agency key or approval system is stolen, how far does the damage reach?
• When another government demands the same capability, on what basis can a platform refuse?
• If criminals move to their own encryption tools, what effectiveness is left?

What the argument comes down to

Ghost participants and client-side scanning are not the same technology. One changes the recipient set; the other inspects content on the user’s device before encryption or after decryption.

Both, though, place a state-mandated capability inside the boundary that end-to-end encryption is supposed to protect. One changes “who receives this,” the other changes “what gets inspected before sending.” Either way, a new privileged capability lands in the client and the distribution infrastructure, and that capability becomes something to attack and abuse.

A ghost participant does not decrypt anything. It quietly changes who you are encrypting to. That is exactly why the math of end-to-end encryption can stay intact while its security guarantee falls apart.

References

[1] Reclaim The Net. France Moves to Break Encrypted Messaging.

[2] Electronic Frontier Foundation. A Win for Encryption: France Rejects Backdoor Mandate. 2025-03.

[3] French National Assembly. Proceedings on the narcotics enforcement bill. Assemblée nationale.

[4] European Commission. ProtectEU: European Internal Security Strategy. 2025-04-01.

[5] Abelson, H. et al. Keys Under Doormats: Mandating Insecurity by Requiring Government Access to All Data and Communications. Journal of Cybersecurity 1(1), 2015.