On Wed, 3 Sep 1997, Will Rodger wrote:
Yes, but - Freeh said all products needed to have the _option_ of a key-escrow backdoor built in. The actual deployment of the system should be at the users' discretion. Then again, Sen. Feinstein suggested he needed mandatory key escrow since there was no way to make a voluntary system work. Freeh seemed to warm to the idea of making key escrow mandatory.
Will is right to say Feinstein was harping on mandatory key escrow the entire time. I disagree, though, that Freeh "seemed to warm" to the idea; it's been a wet dream of the FBI for the longest time. Towards the end of his testimony he was perhaps less guarded in his calls for it, that's all. As for the backdoor, Freeh was vague on what that would mean. At one point he said it could be done in a mandatory or voluntary manner as long as it got done. At another he talked about mandating it but giving users the option to turn it off -- but then what's the use of mandating it? I've attached some excerpts from the transcript below that might be helpful.
Unfortunately, he added, mandatory key escrow isn't a possibility - or foolproof, either.
I didn't catch him saying mandatory k.e. isn't a possibility, but he did admit it wasn't foolproof. Check out the transcript. -Declan --- [Louis Freeh is talking] Here we're not saying the key recovery standard X, Y, Z. We're telling the manufacturers that they need to have a feature that would allow immediate decryption, and they can do that in the cheapest, most efficient way that they can design. And I think they can do that fairly easily. [...] There are a number of ways that that could be implemented, but what we believe we need as a minimum is a feature implemented and designed by the manufacturers of the products and services here that will allow law enforcement to have an immediate lawful decryption of the communications in transit or the stored data. That could be done in a mandatory manner. It could be done in an involuntary manner. But the key is that we would have the ability, once we have the court order in hand, to get that information and get it real-time without waiting for what it would take for a supercomputer to give us, which is too long for life or safety reasons. [...] Mandatory key recovery, to the extent that it was implemented, would be the best law enforcement solution. I would not be candid with you if I told you anything other than that. [...] I think we can design a system short of mandatory key recovery which will work certainly better than no system at all. And I think the precepts of 909 and some additions which could be added thereto will give law enforcement at least a fighting chance, which is really what we're asking for in this context, to keep a technique which is very valuable. I don't think we'll ever solve the problem 100 percent. There are loopholes now. There will be loopholes even with a mandatory key recovery system. What we want to try to do is design an infrastructure which will give us as many access points for that court order as possible. And that's the end game that we're involved in right now.