Posted online news accounts of the McCain-Kerrey bill have implied that the a court order is required under the bill to get keys. Eg, from recent postings, [AP, 07/09/1997] As with wiretaps, authorities would have to obtain court orders to make the keys available for law enforcement. ^^^^^^^^^^^^^^^^^^^ ... Sponsored by Kerrey and Sen. John McCain, R-Ariz., that bill would set up a key recovery system to give computer companies strong incentives to make keys available to investigators who obtain a court's permission. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ [Wired, 11.Jul.97] Law enforcement could then access that copy of your key through a court order. ^^^^^^^^^^^^^^^^^^^^^ I find this distressing, because I have read the bill, and a court order is most emphatically NOT required. Only a form specified by J. Reno. This is a tricky point in the bill, but notice that: (1) Court orders are not required for wiretaps in the US. While it may be true that court orders are used most of the time when wiretap evidence is used in a criminal trial, there are a number of exceptions. (2) There is no restriction in the bill to getting keys to decipher communications covered by the wiretap laws. It lets cops get keys to many other communications. Part of the point to using encryption is to use public networks where access to the encrypted data need not be hidden or withheld from the public. Under S.909, if the cops can get access to the data, then they can get the keys without any court order. (3) Even if there is a court-ordered wiretap, there is no obligation to notify the judge that keys will also be seized. While it may seem obvious that if a judge is willing to order a wiretap, he is willing to order key seizure, I don't think this is necessarily the case. When a judge orders a wiretap, he is supposed to be balancing the possibility of getting incriminating evidence against the invasion of privacy of innocent parties. If the keys of innocent parties are being seized as well, it may affect the judge's balancing. (4) In S.909, all of the requirements on law enforcement officials can be lifted by executive order. Am I wrong, or are all the news accounts wrong? Please let me know if there is any flaw in my analysis. Roger Schlafly rschlafly@attmail.com (Please CC me on any followup, as I only occasionally read this list.)