§03 · A way in does not check ID

Here is the engineering fact that does not depend on anyone's intent, and it is the hinge of the whole case. A capability built so that a lawful actor can reach protected data is a property of the system, not of the warrant. Once the path exists, it exists for whoever can find it, compel it, copy it, or steal it. The system cannot tell whether the hand on the key arrived with a judge's order or without one, because the key is a feature of the lock, not of the person holding it. This is exactly why defence-in-depth doctrine, the Five Eyes statement included, treats every standing access path as attack surface to be minimised.verified

One building, two desks, one lock. Each desk is right on its own. The wall between them is the case: as long as the two memos never lie on the same desk, the question the wall keeps apart, whether the lock can hold a way in that only the right people ever use, never has to be answered.

Picture the building. One roof, Government of Canada. Two desks, divided by a wall. On the left desk a memo says secure by default, reduce the attack surface, build no standing way in. On the right desk a memo asks providers to build exactly that. Beneath the floor, shared by the whole building, is a single lock, and a line runs from the right desk down to it. The wall is the mechanism. As long as the two memos never lie on the same desk, the government never has to answer the one question the wall is built to keep apart: whether the lock at the bottom of the building can hold a way in that only the right people ever use. A way in does not check ID. The partition is what lets the answer stay unsaid.