IP: Mandatory Key Escrow Violates Our Constitutional Traditions

[David Farber <farber () cis upenn edu>]

---------- Forwarded message ----------
Text of this letter can be found at:
http://www.cdt.org/crypto/legis_105/SAFE/97093_profs.html
http://viper.law.miami.edu/~froomkin/lawprof-letter.htm
--------


[This open letter was sent to all members of the House Commerce Committee.]


September 23, 1997


The Honorable Thomas J. Bliley
2409 Rayburn HOB
Washington, DC 20515


Dear Chairman Bliley,


        We write to express alarm about an unprecedented proposal that has
been advanced to impose criminal penalties on the manufacturing or
distribution of domestic encryption products that do not contain a
government-mandated "back-door." The proposal, drafted in large part by the
FBI, has already been adopted by the House Intelligence Committee, and may
be offered soon in the Commerce Committee by Reps. Michael Oxley and Thomas
Manton as an amendment to H.R. 695, the "Security and Freedom through
Encryption (SAFE) Act." The SAFE Act was originally intended to loosen the
export controls that have blocked U.S. companies from offering products
with strong encryption on the global market. The Oxley-Manton amendment,
however, changes fundamentally the nature of SAFE. Rather than liberalizing
limitations on encryption, the amendment drastically increases the
government's control over the use of both domestic and international
encryption technologies.


        We believe that this is a profound mistake. Never in peacetime has
our government attempted so completely to monopolize a single form of
communication; never has it required, in effect, a license to exercise the
right to speak. But that is what this amendment would do. In our view, not
only could this amendment make our citizens less secure, but it would also
contravene fundamental principles  of our constitutional tradition. We
would no longer be a leader protecting individual rights internationally;
we would instead become the architect of the most comprehensive
surveillance plan the world has seen since the end of the Cold War.


        We are law professors who believe this plan is as unconstitutional
as it is unwise. We may individually differ in our reasons, but we have
collected below at least some of the reasons that we take the position we
do. We urge Congress not to take this step now. No showing has been made to
justify so massive a change in our constitutional protections.


I.      An Attack on Basic Constitutional Rights


Freedom of Speech


        The amendment raises profound questions about rights of free
speech. The right to speak freely includes not only the right to say what
you want, to whom you want. It also includes the right to choose how to
speak, and whether to speak at all. The right has no preconditions. In
America, at
least, you do not need a license to speak; you do not need the government's
permission to speak in the language of your choice; and you do not have to
organize your speaking in a way that happens to suit the needs of the
government. The Constitution no more permits Congress the power to regulate
the software within which speech may occur than it give Congress the power
to say what kind of paper a diary may be written upon. These are choices
rightly left to the individual.


         These freedoms are a basic part of the fabric of American
constitutional law.  The Supreme Court has upheld them in innumerable
rulings, including McIntyre v. Ohio Elections Commission (affirming the
right to anonymous political speech); Riley v. National Fed'n of the Blind
("Mandating speech that a speaker would not otherwise make necessarily
alters the content of the speech."); Wooley v. Maynard (holding
unconstitutional New Hampshire's requirement that cars display license
plates bearing the state motto); West Virginia State Board of Education v.
Barnette (holding that compelled recitation of pledge of allegiance
violates the First Amendment) .


         The amendment would undermine these constitutional rights to free
speech. By imposing requirements on cryptographic programs - used by
individuals and corporations to protect the privacy and security of their
papers and telephone or e-mail conversations - it would in effect be
mandating the code software writers may write. Only governmentally approved
code could be used to transmit speech the speaker wants to protect; authors
and speakers would be required to use this code to say what they wanted to
say. This forced speech, we believe, takes the government's power too far.


        We accept that law enforcement agencies, if they obtain a warrant
based on a showing of probable cause, can intercept a person's
communications and seize a person's data.  But that power exists after a
finding of probable cause has been made. This amendment regulates citizens
before any finding of probable cause. It regulates the programs that
citizens may use before they speak at all. It requires every citizen to fit
his speech to a program essentially designed by the government, so that the
government is better able to monitor the citizen's speech. This preemptive
strike on free speech is without precedent in our constitutional tradition.
We believe it is profoundly misguided. Under the theory of the amendment,
the only permissible encrypted speech is governmentally licensed encrypted
speech. But this, we believe, the government cannot require.


Fourth Amendment Rights


        The amendment also raises troubling questions about the right to
privacy. Our Constitution presumes that there will be no secret searches.
Not only must the government ordinarily obtain a warrant for a search, but
its agents executing the warrant must also announce their presence.  This
is the knock and notice requirement, and the Supreme Court has made it
clear that this is a fundamental element of Fourth Amendment protections.
The amendment would abrogate this fundamental protection. By requiring
users of encryption to place their key with third parties who can be
compelled under the statute to hand that key over to the government, the
amendment makes possible secret searches by the government on an
unprecedented scale. These are not just telephone calls that the government
needs contemporaneously to search. It includes documents on a computer
disk, whether bank records or a diary. It is as if the state required the
deposit of house keys with a local bank, so that the government could use
that key secretly to gain access to an individual's house.


         More fundamentally, the amendment does violence to our Fourth
Amendment values by forcing all citizens to communicate in a way that
limits their ability to protect their own privacy. In an effort to downplay
the significance of its proposal, the FBI has argued that it is only
seeking to ensure the ability to obtain plaintext of data that it has
already obtained in encrypted form.  On this basis, the FBI tries to argue
that it is seeking no new authority.  On the contrary, under current law
and practice, if the government obtains access to encrypted data or
communications using any of the surreptitious means now at its disposal, it
has no power to assure access to the plaintext of that data. This country's
Fourth Amendment has never guaranteed law enforcement's ability to search,
seize, and understand every conversation, communication, or stored record
of every citizen. We have never required that every person -- whether or
not there is probable cause to believe they have committed a crime -- live
in the legal equivalent of a glass house, just so the government can
facilitate surveillance without the notice or consent of the searched.


II.     The Risks of a Global Key Recovery Regime


        We are most concerned, however, with the danger that this proposal
presents internationally. The new communications media are global in
nature. No nation regulates for itself alone. The proposed "solution" to
the encryption issue offered by the amendment will be most effective for
law enforcement only if it is widely adopted internationally. Section 501
of the House Intelligence bill in fact instructs the President to negotiate
agreements with foreign governments for "mutual recognition of any key
management infrastructures." Most countries, however, do not give their
citizens the same privacy protection that our Constitution guarantees our
citizens. Therefore this international recognition could present three
problems for the privacy interests of our own citizens.


        The first is the lack of privacy protection against foreign
government access to keys, whether stored in the U.S. or elsewhere. Few
countries assure privacy protections comparable to ours. Yet the "mutual
recognition" agreements essential to a global key recovery system will
require the exchange of key information with foreign governments. When
other countries request keys, many of these requests will be made on the
basis of procedures far less strict than those required under U.S. law.  In
these cases, it will be difficult or impossible to determine whether the
requesting country has complied with anything comparable to our warrant
requirements.  The risk is even worse when decryption information is held
outside of the U.S., for it will be impossible to assure that adequate
security precautions are followed by the other government's key recovery
system.  As a result, American citizens using encryption, both within the
U.S. and outside of the U.S., will do so without the privacy protections
provided under U.S. law, and without the technical security protections
provided by encryption without a backdoor.


         The second, and more fundamental problem, is the threat the
proposal poses to the historic role of the United States as a defender of
freedom. In countries throughout the world, the targets of surveillance
include dissidents, religious groups, the press, and economic enterprises.
We have long stood to protect the individual against such invasions by
governmental surveillance. Ours is not the society of big brother. Yet in
advancing this proposal, we would become the leader in establishing a new
global surveillance society. Especially where political oppression exists,
this will just increase the threats to liberty for these citizens, or for
our citizens as they may interact with these countries. The risks of key
escrow threaten the press, churches and other non-governmental
organizations, as well as individual citizens.


         Third, a global key escrow regime would be a threat to American
economic security. Other countries will use key escrow as a tool for
economic advantage. Following the American lead, other countries will be
emboldened to criminalize strong encryption and establish a key escrow
system along the lines of the proposed bill. As a condition of doing
business, American companies will be required to hand over their keys, and
in this way, foreign governments could gain the power to decrypt all
business communications that cross their territory. This again would allow
foreign governments to read confidential communications without any notice
to the company that it is under surveillance.


Conclusion


        Congress faces a historic choice about the shape of free speech and
privacy in the next century. In making this choice, there will no doubt be
many questions of profound importance to our constitutional values. But
there is little doubt that the Intelligence Committee substitute and the
Oxley-Manton amendment would inspire the creation of an unprecedented
system of global surveillance, expanding law enforcement authority and
circumventing the protections of the First and Fourth amendments. It is too
radical a change to make with so little thought. We urge you to resist it.




Sincerely,


Keith Aoki
University of Oregon School of Law


Kevin D. Ashley
University of Pittsburgh School of Law


Jack M. Balkin
Yale Law School


William E. Boyd
University of Arizona College of Law


Darryl K. Brown
University of Dayton School of Law


Dan L. Burk
Seton Hall University School of Law


Julie E. Cohen
University of Pittsburgh School of Law


Peter L. Fitzgerald
Stetson University College of Law


Eric M. Freedman
Hofstra University School of Law


A. Michael Froomkin
University of Miami School of Law


Llewellyn J. Gibbons
Franklin Pierce Law Center


Timothy Hoff
University of Alabama School of Law


Jerry Kang
UCLA School of Law


Ethan Katsh
University of Massachusetts


Andrew Koppelman
Northwestern University School of Law


Mark Lemley
University of Texas at Austin School of Law


Lawrence Lessig
Harvard Law School


Jessica Litman
Wayne State University


Henry H. Perritt
IIT Chicago-Kent College of Law


David G. Post
Temple University Law School


Margaret Radin
Stanford Law School


William D. Rich
University of Akron School of Law


Jon Romberg
Seton Hall University School of Law


Jim Rossi
Florida State University College of Law


Pamela Samuelson
University of California at Berkeley School of Law


Mark S. Scarberry
Pepperdine University School of Law


David E. Sorkin
John Marshall Law School


Peter Swire
Ohio State University College of Law


Note:  Institutional references are for identification only.  The views
expressed herein do not necessarily reflect the views of the organizations
referenced.














************************************************************************
"They that can give up essential liberty to obtain a little temporary
 safety deserve neither liberty nor safety."       - Ben Franklin, ~1784
************************************************************************