The Metaphor is the Key: Cryptography, the Clipper Chip and the Constitution

Abstract

Part I of this Article describes advances in encryption technology that are increasing personal privacy, particularly electronic privacy, but reducing the U.S. government's ability to wiretap telephones, read e-mail surreptitiously, and decrypt computer disks and other encrypted information. Specifically, Part I focuses on the Escrowed Encryption Standard (EES), to be implemented in the Clipper Chip and other similar devices.

Part II examines the legal justifications and constitutional implications of the EES proposal. It argues that the EES proposal violates the spirit, although not the letter, of the Administrative Procedures Act and represents an abuse of the technical standard-setting process.

Part III considers the constitutional implications of the more radical proposal that some commentators find implicit in the policies animating Clipper: requiring all users of strong encryption to register their ciphers' keys with the government. Part III concludes that although mandatory key escrow would infringe personal privacy, reduce associational freedoms, potentially chill speech, constitute a potentially unreasonable search, and might even require a form of self-incrimination, the constitutionality of mandatory key escrow legislation remains a distressingly close question under existing doctrines.

Part IV addresses the cryptography controversy as an example of the law's occasionally awkward response to a new technology.

Finally, the Technical Appendix discusses modern cryptographic systems, including the widely-used Data Encryption Standard (DES), and how they can (at least theoretically) be broken by attackers armed with large numbers of relatively modest computers. It also provides an introduction to public-key cryptosystems and to digital signatures, which could represent the most important commercial application of modern cryptographic techniques.

Keywords: cryptography, clipper chip, cyberlaw, Internet law, DES, EES, privacy law