Technology

This year we’ve seen cracks in Windows 11 BitLocker, VeraCrypt developers losing their ability to distribute their software on Windows, and Apple removing encryption support from the HFS+ filesystem. We’ve also seen some cases where public outcry and awareness were able to reverse some of the corporate decisions that removed the freedom of users to run secure software. There was a time when people in tech stood against government mandated keys under doormats¹². Yet in today’s surveillance age, every big company seems like a willing participant in the coming technocracy.

BitLocker

Earlier this year, a security researcher who goes by Nightmare Eclipse found a means to bypass BitLocker encryption on Windows 11 and Server 2025, claiming it looks suspicious enough that it was likely an intentional backdoor by Microsoft³⁴. Some people claim using a Trusted Platform Module (TPM) and boot pin prevents this exploit⁵. The original author has claimed TPM+PIN was exploitable, but he didn’t publish the proof of concept⁶. A few weeks later, Nightmare Eclipse published another BitLocker bypass that affected users who used Defender Offline Scan⁷⁵.

Nightmare Eclipse was criticized for not responsibly disclosing such a major vulnerability, to the point where Microsoft threatened legal action against the developer⁸. In response, Eclipse claimed Microsoft had ignored his previous disclosures and deleted the account he had used to report them⁹. Several other researchers and developers also spoke up about how Microsoft Security Response Center (MSRC) had a history of closing legitimate reports and silently patching vulnerabilities, not giving credit to the original reporters and refusing to pay out bug bounties¹⁰¹¹¹².

VeraCrypt and WireGuard

VeraCrypt, an open-source disk encryption system based on TrueCrypt, had their publishing account for Microsoft Windows terminated in March, removing their ability to publish updates¹³. Tools like VeraCrypt require kernel-level implementation, and users get scary red boot screens if they try to disable verification for these low-level drivers.

This policy change by Microsoft affected other open-source security projects, such as the popular VPN protocol WireGuard¹⁴. Microsoft claimed this was due to new requirements of mandatory account verification for partners in their hardware drivers program¹⁵, but developers claimed they completed these new verification requirements and were still locked out of their accounts anyway¹⁶. Microsoft VP Scott Hanselman publicly responded, stating he was actively working to restore the accounts for WireGuard and VeraCrypt¹⁷ and that “Not everything is a conspiracy sometimes it’s literally paperwork¹⁸.”

VeraCrypt was forked from the TrueCrypt project after it was very suddenly discontinued by the original authors. TrueCrypt’s project page put up a very cryptic message encouraging users to switch to their operating system’s native encryption¹⁹ and included instructions for enabling BitLocker²⁰. Some have wondered if shutting down the development was a type of warrant canary; a response for a National Security Letter²¹. A TrueCrypt author claimed at the time that forking the project was “impossible²²²³²⁴,” and yet here we are over a decade later with VeraCrypt being fully maintained and actively developed.

MacOS and Extended Filesystem Encryption

Apple announced that macOS 28 will drop support for HFS+ encrypted volumes²⁵²⁶ and posted a support article indicating users should back up their data and migrate to APFS encryption²⁷. What’s interesting is that they’re not dropping support for their legacy filesystem entirely, just versions of it that are encrypted. It begs the question, is support being dropped because the previous filesystem had strong encryption? Is Apple trying to move users to formats that aren’t really secure, allowing for their own backdoors to be used at government requests?

AMD Hardware

AMD recently removed support for Transparent Secure Memory Encryption (TSME), also known as Memory Guard, from their consumer processors. These came via updates to their processor firmware packages used on various operating systems, including Windows and Linux. Due to public outcry over the removed feature, AMD did eventually reinstate memory encryption²⁸²⁹.

Conclusions

Each one of these stories individually could have a completely benign explanation. Many companies are trying to tighten security in the new era of large language models and tools that make it easier to find security issues and vulnerabilities. Some developers and companies may want to drop unmaintained code to reduce attack footprints, such as the case with Apple and legacy filesystems. However, all of these stories coming so close together, back-to-back within weeks of each other, suggest a different picture.

I don’t believe a Microsoft VP when he claims the VeraCrypt and WireGuard situations were a “paperwork” issue¹⁸. Microsoft has aggressively made it impossible for normal consumers to set up Windows 11 without an Internet connection or Microsoft account during their initial setup. Local accounts on Windows 11 require looking up specific terminal commands as if they were game cheat codes. Meanwhile, companies like Discord are requiring government ID for some of their users³⁰, and many governments are pushing legislation for mandatory ID verification for web services and operating system use under the lie of protecting children³¹³²³³. It’s obvious these laws have nothing to do with children and are really designed to uniquely identify and track Internet usage for everyone, tying your identity to every action taken both online and offline.

I think we’re seeing security in major parts of the tech industry intentionally being eroded. Strong open-source encryption systems are being stifled in exchange for broken tools from big tech companies that have zero interest in user privacy. There seems to be a concerted effort to remove all real encryption, security and privacy from consumer software. This doesn’t seem like incompetency mistaken for malice. This seems intentional, and I predict we’ll continue to see more stories in the coming months and years. I expect more exploits and backdoors in major tools specifically geared around mass data collection, removing data privacy and removing anonymization. It’s been happening for years and now it’s accelerating.