Inside Risks: Keys Under Doormats

• Published in: Communications of the ACM 2015-10, Vol.58 (10), p.24
• Main Authors: Abelson, Harold "Hal", Anderson, Ross, Bellovin, Steven M, Benaloh, Josh, Blaze, Matt, Diffie, Whitfield "Whit", Gilmore, John, Green, Matthew, Landau, Susan, Neumann, Peter G, Rivest, Ronald L, Schiller, Jeffrey I, Schneier, Bruce, Specter, Michael A, Weitzner, Daniel J
• Format: Magazinearticle
• Language: English
• Subjects: Data integrity; Internet access; Law enforcement; Regulation
• ISSN: 0001-0782; 1557-7317
• DOI: 10.1145/2814825

Twenty years ago, law enforcement organizations lobbied to require data and communication services to engineer their products to guarantee law enforcement access to all data. After lengthy debate and vigorous predictions of enforcement channels going dark, these attempts to regulate the emerging Internet were abandoned. In the intervening years, innovation on the Internet flourished, and law enforcement agencies found new and more effective means of accessing vastly larger quantities of data. Today, they are again hearing calls for regulation to mandate the provision of exceptional access mechanisms. In this column, computer scientists and security experts, many of whom participated in a 1997 study of these same topics, explore the likely effects of imposing extraordinary access mandates. Computer scientists with extensive security and systems experience believe law enforcement has failed to account for the risks inherent in exceptional access systems. Based on their considerable expertise in real-world applications, they know such risks lurk in the technical details.