Writing about PGP's key recovery mechanism (CMR (Commercial Message Recovery) or ADK (Additional Decryption Key)), Dave Del Torto quotes from a letter he sent to info@kra.org:
I'm not aware of the KRA's public position on the recovery of plaintext using cryptographically sound and ethically responsible alternatives to the escrowing of keys in organizational situations, e.g. PGP's Additional Decryption Key (ADK) mechanism.
I don't see that ethics has any bearing on the difference between Key Escrow, and PGP's CMR "message recovery" design. They are both just yet another protocol to allow third parties to decrypt encrypted traffic. Ethics enter into the discussion when one one starts to argue about which third parties will be able to eavesdrop on the traffic. This issue is largely orthogonal to the general technique used. Parties which people are most concerned about having access to data are the spooks and governments via organisations such as NSA, GCHQ, ECHELON etc. In a commercial setting there is also some political debate about whether the employee has any expectation of privacy. One might also argue about whether it is ethical to design software which helps or makes it easy for third parties to gain access to the plaintext in general.
What is the KRA's public position on PGP's ADK?
So one has to be clear of one's aims in asking KRA if they think PGP's CMR or ADK is a nice technology for adding NSA backdoors to crypto. Say, for example that they decided that CMR is neater than their CKRB mechanism. Now what? NSA/KRA lobby companies to include a modified CMR with the NSA's public key as a mandatory additional recipient? And NAI gets `asked' by the NSA to burn an NSA public key into PGP 7. Adam