Critical analyses of security have focused on the production of knowledge, techniques and devices that tame unknowns and render social problems actionable. Drawing on insights from Science and Technology Studies and the emerging field of ‘ignorance studies’, this article proposes to understand law and security as messy assemblages of knowledge and non-knowledge. Starting with legal challenges brought against the NSA, GCHQ and other intelligence agencies after the Snowden revelations about mass surveillance, I show how different modes of non-knowledge are enacted and not just ‘tamed’: uncertainty, ignorance, secrecy, ambiguity, and error. The enactment of non-knowledge has important consequences for how we understand security practices, the relation between security and law, and public challenges to mass surveillance in a digital world.