The Surveillance System That Got Surveilled

The Surveillance System That Got Surveilled: 15 Observations on the FBI Wiretap Hack and the Exquisite Irony Thereof

WASHINGTON D.C. — In a development that has delighted approximately every civil liberties lawyer, conspiracy theorist, and mildly attentive adult on the planet, the Federal Bureau of Investigation has confirmed that its wiretapping infrastructure — the elaborate, government-mandated apparatus through which it listens to everyone else — has itself been listened to, by parties unknown, for a period that investigators are describing as “some time,” which is bureaucratic English for “we genuinely don’t know how long and we’re not entirely sure we want to.”  Are you looking for information on the American surveillance system?

The incident has been officially classified as a “major cyber incident.” In American governmental parlance, this translates roughly to: it’s gone properly wrong and we’d like you to remain calm while we work out exactly how wrong.

The culprit, according to U.S. officials, is a Chinese state-sponsored hacking group operating under the name Salt Typhoon — a moniker that sounds considerably less threatening than the situation warrants, suggesting perhaps a mildly disappointing spa treatment or a regional weather forecast for Shropshire rather than the largest intelligence compromise in American history.

The watchers were watched. The eavesdroppers were eavesdropped upon. The surveillance apparatus was surveilled. It is, if nothing else, structurally elegant — the sort of irony that would delight a philosophy undergraduate at three in the morning, and apparently also Beijing.

---

The FBI Noticed “Suspicious Activity”… On Its Own Computers

The Surveillance System That Surveilled Rather More Than Intended

One must extend a degree of institutional sympathy. The FBI — an organisation whose entire constitutional mandate involves detecting suspicious behaviour before it becomes irreversible — managed, after what investigators believe was years of unauthorised access, to notice that something suspicious was occurring. To them. On their own systems. In their own building.

It is, as Frankie Boyle might observe, the organisational equivalent of a locksmith spending thirty years telling everyone else they need better locks, and then discovering someone has been living in his attic since 2021.

Cisco reported that in at least one case, Salt Typhoon maintained access for three full years before detection. Three years. At that point, they are not hackers. They are lodgers. They have rights. They should be getting post.

“This is the nightmare scenario we always feared but never quite believed could happen,” a former senior FBI official told reporters, speaking on condition of anonymity — presumably on the reasonable grounds that someone was, in all likelihood, still listening.

Professor Archibald Plum, Senior Research Associate at the Wiltshire Institute for Institutional Self-Awareness (funded, one assumes, entirely by irony), said the timeline was “quite something.”

“In British civil service terms,” he noted, “three years of undetected foreign access is actually rather quick. Our procurement process for detecting it would have taken longer.”

---

“Unclassified Data” Is Whitehall for “Nothing to See Here, Move Along”

Officials were at considerable pains to reassure the public that some of the compromised material was “unclassified,” which is the governmental equivalent of informing someone that their house is on fire whilst noting that the garden shed, technically, remains intact.

The “unclassified” material in question included: personal data, telephone records, surveillance metadata, and comprehensive records of precisely which Americans the FBI was investigating and why.

Perfectly routine, obviously.

Metadata, officials further noted, is “not really personal data.” Metadata, they did not mention, happens to know who you rang, when, for how long, from precisely where, and with what frequency — everything about you, in other words, except perhaps which biscuit you favour with your tea. Given sufficient processing time, it would probably work that out as well.

A Freedom of Information request to the FBI for their internal definition of “unclassified” was returned with the helpful annotation: “This document is classified.” The irony, one assumes, was unintentional. One assumes.

---

LEAKED MEMORANDUM — FBI Cyber Division (UNCLASSIFIED — Please Do Not Publish)

Inside the Surveillance System Beijing Found Remarkably Accommodating

TO: All Field Offices
FROM: Cyber Division, Washington D.C. Headquarters
RE: Communications Guidance — Recent “Major Incident”
CLASSIFICATION: UNCLASSIFIED (We Mean It This Time)

Effective immediately, all personnel are reminded to characterise the recent network intrusion as the result of “sophisticated tactics deployed by a nation-state threat actor.” Under no circumstances are staff to use the phrases “we hadn’t updated that since the Blair years,” “the door was essentially open,” or “yes, in retrospect, this was rather foreseeable.”

When asked about the duration of access, staff should respond: “We are unable to comment on the operational timeline,” and promptly redirect the conversation toward encryption backdoors, which we continue to support, despite recent events.

Congress has been notified. A formal hearing has been scheduled. Please ensure your “concerned but not catastrophically alarmed” expression is prepared. The “alarmed but projecting competence” expression is also acceptable. The “genuine panic” expression is reserved for Deputy Directors and above.

All personnel are now encouraged to use end-to-end encrypted messaging applications. Yes, the same ones we have spent three decades lobbying to have outlawed, backdoored, and/or regulated out of existence. That is correct. Please do not raise this with journalists.

— Cyber Division Leadership
P.S. — The router in Section C has still not been updated. IT advises Q3. This is the third Q3 they have cited. We have stopped asking.

---

The Wiretappers Got Wiretapped: A Brief History of Poetic Justice

The hack targeted CALEA systems — infrastructure that American telecommunications companies are legally required to build, maintain, and keep permanently accessible, so that the government may, upon presentation of the appropriate paperwork, listen to whatever it likes.

Congress mandated this arrangement in 1994, when the internet was still a novelty and “cybersecurity” appeared primarily in science fiction paperbacks. The logic was admirably straightforward: build a door. Install a lock. Give the government a key. What, one might reasonably ask, could go wrong?

What went wrong, as the past several years have patiently illustrated, is that when you legally mandate a backdoor into the backbone of a nation’s telecommunications infrastructure, you have, by definition, created a mandatory vulnerability in the backbone of a nation’s telecommunications infrastructure. Salt Typhoon found the door that the law required everyone to install, tried the handle, and — finding it, in the manner of these things, rather less secured than advertised — walked straight in.

“Something like Salt Typhoon was bound to occur and probably will again if nothing is changed,” cybersecurity expert Matt Blaze told Congress in April 2025, in what must rank as the most elaborately footnoted “I told you so” in the history of expert testimony.

The FBI’s considered response to this revelation? They now recommend all Americans use encrypted messaging applications — the very applications the Bureau has spent thirty years attempting to backdoor, restrict, and treat as prima facie evidence of a suspicious character.

The locksmith is distributing padlocks. The locksmith has opinions about padlocks. The locksmith would, ideally, like a spare key to your padlock. These desires are, for the moment, in tension.

---

China May Be Responsible, Making This an International Blame Potluck

America’s Surveillance System: Open to the Public, It Turns Out

American officials have attributed the operation to Salt Typhoon, linked to China’s Ministry of State Security. By August 2025, the FBI confirmed the group had compromised over 200 companies across 80 countries, including the full roster of major American telecoms: AT&T, Verizon, T-Mobile, Lumen Technologies, Charter Communications, and Windstream — essentially every carrier you have ever been placed on hold with, now with the added distinction of having been comprehensively infiltrated by a foreign intelligence service.

Beijing has denied all involvement. This is, of course, standard diplomatic procedure in matters of state-sponsored cyber espionage — the geopolitical equivalent of a man standing in your kitchen, consuming your food, and, when challenged, explaining that he has never visited a kitchen, is unfamiliar with the concept of food, and would like to lodge a formal complaint about the accusation.

Senator Mark Warner, Vice Chairman of the Senate Intelligence Committee, described the telecom breach as “the worst telecom hack in our nation’s history” — a designation that, given the competitive field of 2024 and 2025, represents genuine achievement.

Dara Ó Briain, who was not formally consulted but whose sensibility this entire affair rather resembles, might note that there is something philosophically arresting about a country that spends billions building a surveillance state only to discover that the surveillance state has been surveilled by a rival surveillance state, and that the lesson drawn is: more surveillance.

---

“All Technical Capabilities Deployed” — A Reassurance That Reassures No One

The FBI announced, with the gravity such moments demand, that it had deployed “all technical capabilities” in response to the breach. This phrase, on first encounter, conjures images of considerable institutional firepower — the full machinery of American law enforcement, roused to action, marshalled, purposeful.

In practice, analysts familiar with such announcements suggest it means that several very tired people changed some passwords, restarted a server, and are now “monitoring the situation,” which is what one does when one has exhausted all other available options.

“Sophisticated tactics” is, similarly, performing considerable rhetorical work throughout official communications. Every breach is sophisticated. None are routine. None are the consequence of a known vulnerability that sat patiently in a public security advisory since 2017, waiting to be addressed, growing quietly impatient.

Salt Typhoon’s actual method of entry involved exploiting known vulnerabilities in routers, firewalls, and VPN products — the digital equivalent of entering through a door marked “AUTHORISED PERSONNEL ONLY” while wearing a hi-vis jacket and carrying a clipboard. No one questions the clipboard.

---

Congress Has Been Notified. A Hearing Is Forthcoming. Hackers Remain Unconcerned.

The Surveillance System With a Mandatory Door and an Optional Lock

Congress was duly notified of the breach, activating the full mechanism of American legislative response: a scheduled hearing, a press release, and a bipartisan display of grave concern expressed via the medium of firmly worded statements.

Nothing, in the long history of state-sponsored cyber operations, has given a foreign intelligence service pause quite like the knowledge that a Senate subcommittee will, in approximately six to eight weeks, convene in a wood-panelled room to ask a series of questions about what a router is, receive a series of patient answers about what a router is, and adjourn without updating a single firewall.

The Cyber Safety Review Board, which had been investigating the original Salt Typhoon breach with what one imagines was considerable urgency, was dismissed by the Trump administration before it could complete its report. The investigation remains unfinished. The findings — potentially the most comprehensive official account of the hack’s full scope — remain unwritten.

This is what, in policy circles, one calls “suboptimal sequencing.”

The FBI is simultaneously managing proposed budget cuts of approximately $500 million, significant staff reductions, and — in March 2026 alone — three separate cybersecurity incidents: the surveillance network breach, the disclosure of a 2023 hack exposing Epstein investigation files, and a breach of FBI Director Kash Patel’s personal email account.

At a certain point, one stops calling these incidents and starts calling them a standing arrangement.

---

The FBI Now Knows How the Rest of Us Feel

For decades, the ambient understanding amongst ordinary citizens — on both sides of the Atlantic — has been that one is, in some vague but persistent sense, being observed. That the telephone is not entirely private. That the data flows somewhere, to someone, for purposes one has not been consulted about.

The FBI now has the opportunity to sit with that feeling. To inhabit it. To understand, from the inside, what it is to go about one’s business in the reasonable knowledge that somewhere, in a room one has never seen, someone is scrolling through records of everything one has done, wondering which bits are interesting.

Welcome, as they say, to the club. The membership fee has already been deducted. The terms and conditions are forty-seven pages. No one has read them.

“They weren’t just listening to Americans,” a former senior official said. “They were listening to us listening to Americans.”

It is recursive. It is Kafkaesque. It is, in its strange way, the most honest the surveillance state has ever been about what surveillance states actually do — which is, ultimately, this. Exactly this. But to someone else.

---

Somewhere, a Junior Analyst Is Having a Very Difficult Tuesday

In every institutional security breach, without exception, there is a relatively junior member of staff sitting in a conference room they were not expecting to be in, in front of a cup of tea that has gone cold, being asked, by someone who could not locate the server room with a map, whether they “clicked on anything unusual” in the last several years.

The junior analyst is considering their options. They are thinking about their degree. They are thinking about the postgraduate programme in landscape architecture they almost applied for. The hedgerows, they reflect, are not subject to CALEA compliance. The hedgerows have not been hacked. The hedgerows are, by any reasonable measure, doing considerably better than the FBI.

The hedgerows did update their firmware.

---

📊 LONDON PRAT POLL — What the British Public Made of It All

Q: Upon learning that China had spent years inside the FBI’s wiretapping system, your immediate reaction was:

• ✅ 58% — “Hang on — they lost what?“
• ✅ 21% — “One does feel a certain sympathy. Briefly.”
• ✅ 12% — “I’d like to know what they found. Asking for a friend.”
• ✅ 6% — “This does rather explain the last few years, doesn’t it.”
• ✅ 3% — “I assumed this was already happening. I assumed it had always been happening.”

Methodology: 1,400 respondents. Margin of error ±3.2%. Survey conducted via encrypted application, because apparently that’s where we’ve arrived.

---

The Part Where It Stops Being a Joke

There is a point at which satire becomes simply a more palatable container for information that is, at its core, rather troubling.

The FBI constructed a legal framework — CALEA — that compelled every American telecommunications company to build a permanent surveillance backdoor into their networks. The argument, repeated across thirty years of Congressional testimony, Inspector General reports, and press conferences, was consistent: only the right people would use it. The door would have a very good lock. The key would remain in responsible hands.

Salt Typhoon found the door. Picked the lock. Walked in. Sat down. And watched — apparently for years — as the FBI watched Americans. They saw the investigation targets. The evidence. The informants. The full operational picture of American law enforcement priorities, laid out with the kind of accessibility that suggests the lock was not, in fact, particularly good.

This is not, ultimately, a story about Chinese hackers. It is a story about what happens when governments demand powers they cannot secure, build infrastructure they cannot protect, and respond to the inevitable consequences by demanding more of the same.

The backdoor that was supposed to make America safer became the entry point for the largest intelligence compromise in American history. The surveillance system built to watch everyone became, for years, a window through which everyone else watched back.

The question that remains — quiet, persistent, rather more serious than anything else in this piece — is straightforward enough:

What, precisely, did they see? And what are they doing with it?

---

The FBI’s surveillance infrastructure, built under the 1994 Communications Assistance for Law Enforcement Act, was compromised in what Senator Mark Warner described as the worst telecom hack in American history. Salt Typhoon, linked to China’s Ministry of State Security, breached at least nine major U.S. telecoms, accessing call records for over a million Americans and intercepting communications from both presidential campaigns, including phones belonging to Donald Trump and JD Vance. By August 2025, the FBI confirmed Salt Typhoon had compromised more than 200 companies across 80 countries. The Trump administration disbanded the Cyber Safety Review Board before it completed its investigation. The FBI subsequently offered a $10 million bounty for information on Salt Typhoon operators and — reversing thirty years of institutional policy — began recommending Americans use encrypted messaging applications. March 2026 saw three separate FBI cybersecurity incidents, including the surveillance network breach, exposure of Epstein investigation files, and a hack of Director Kash Patel’s personal email.

Auf Wiedersehen, amigo!

The Wiretappers Got Wiretapped