# The Crypto Wars: thirty-three years of the same argument

> In 1993 a government proposed a telephone chip whose encryption was strong and whose keys it kept a copy of. The proposal died in three years. The argument did not: it returned as export control, as a standards backdoor, as a court order against a phone manufacturer, and as a secret notice to a cloud provider that is still before a tribunal. Every round asks whether exceptional access can be added to a secure system, and every round gets the same engineering answer.

Source: https://ronutz.com/en/learn/the-crypto-wars  
Updated: 2026-09-07

---

## One argument, four rounds

A government wants lawful access to communications. Cryptographers reply that a system built to be readable by an authorised party is a system built to be readable, and that the authorisation is a policy which can change while the readability is a property of the design which cannot. That exchange has now run for thirty-three years without either side conceding, and its four rounds - export control, the Clipper Chip, the standards backdoor, and the present fight over cloud encryption - are usually told separately. They are one story, and a practitioner meets its residue constantly: in cipher suites named "export", in a key length that stayed at 56 bits for two decades, in the design decision to hold keys on a device rather than a server.

The [encryption family history](https://ronutz.com/en/learn/encryption-family-history) covers the first round from the algorithm's side, and the [EFF article](https://ronutz.com/en/learn/electronic-frontier-foundation) covers the litigation that ended it. This is the policy arc, and the middle rounds.

## 16 April 1993: the chip

The Clinton White House announced it by press release: a tamper-resistant chip, officially the MYK-78 and universally the Clipper Chip, to be built into secure telephones. The encryption was genuinely strong - an algorithm called Skipjack, designed by the National Security Agency (NSA). The bargain was in the key. Each chip's unit key was split into two shares, held by two separate escrow agencies, which law enforcement with the appropriate authorisation could obtain and recombine. Every encrypted call also carried a Law Enforcement Access Field (LEAF), which contained the session key wrapped under that unit key, so that a recovered unit key unlocked the traffic.

Two objections arrived immediately and they were different in kind. The first was civil-liberties and political, and it produced an unusually broad coalition - technologists, privacy advocates and industry, joined by politicians across the spectrum. The second was narrower and more damaging: Skipjack was classified. It could not be evaluated by the public, and a small group of cryptographers shown it under agreement could not publish. A cipher nobody may examine cannot be trusted by the people asked to depend on it, whatever its actual quality - which is the argument this catalogue's [RSA entry](https://ronutz.com/en/industry/rsa-security) records being made again about a random-number generator a decade later.

Then, in August 1994, Matt Blaze of AT&T Bell Laboratories published "Protocol Failure in the Escrowed Encryption Standard", and here the record deserves more care than it usually gets. Blaze did not break Skipjack. What he showed was that a determined user could communicate through a Clipper device *without transmitting a valid LEAF* - obtaining the encryption while defeating the escrow. He said as much in the paper. The popular shorthand, that Blaze found "security flaws in Clipper", is not quite what happened and the distinction matters: the escrow mechanism, not the cipher, was the fragile part, and the people the scheme was aimed at were exactly the people willing to do the extra work to bypass it. A criminal could have strong encryption without escrow; an ordinary citizen would have escrow by default.

AT&T built one telephone using the chip. It was the only product that ever shipped with it. By 1996 the proposal was dead.

## Why escrow keeps losing on engineering grounds

The recurring argument is not that governments have no legitimate interest. It is that exceptional access is a structural change to a system rather than a permission added to it.

A system with a mechanism for authorised decryption has that mechanism whether or not the authorisation is present. The mechanism must be implemented in every device, maintained across every version, and protected in transit and at rest; the escrow database becomes a single target holding the keys to everything the scheme covers; and the access path must itself be authenticated, which means the security of the whole system now rests on the security of a process rather than on mathematics. The [Nortel entry](https://ronutz.com/en/industry/nortel-bay) records a company whose credentials were taken and which changed passwords without evicting the intruder; the [Ericsson entry](https://ronutz.com/en/industry/ericsson) records a lawful-interception subsystem present in a switch while the auditing subsystem was not purchased, and a year of tapped calls that nobody noticed. Both are exceptional access working exactly as designed, for someone else.

## The sequel, 2013 to now

The proposal died; the goal did not.

In 2013 the Snowden disclosures showed that while the public argument had been about escrow, the NSA had been pursuing the same end quietly - through the standards process, as the [Dual_EC_DRBG story](https://ronutz.com/en/industry/rsa-security) records, and through the fibre-tap infrastructure the EFF spent sixteen years litigating over. The response from industry was not a policy position but a build: end-to-end encryption became a default in consumer messaging, and phones began holding keys the manufacturer could not produce.

That produced round three. After the 2015 San Bernardino shooting, the FBI obtained a court order under the All Writs Act directing Apple to build a version of its operating system that would let the Bureau brute-force a locked iPhone. Apple refused, arguing that the software did not exist, that building it would create a capability that could be demanded again, and that the demand was legislative in nature and belonged in a legislature. The case ended without a ruling when the Bureau found another way in, which left the legal question exactly where it had been.

Round four is running now, and it is the one to watch because it is the first where a government has largely got what it asked for. In January 2025 the United Kingdom's Home Office issued Apple a technical capability notice under section 253 of the Investigatory Powers Act 2016 - a secret order, which the recipient may not disclose - reportedly requiring the capability to access iCloud data protected by Advanced Data Protection, Apple's end-to-end encryption option. Apple did not build it. In February 2025 it withdrew the feature from the United Kingdom instead, so that British users now have less protection than users elsewhere. Apple and, separately, Privacy International and Liberty went to the Investigatory Powers Tribunal, which in April 2025 refused the government's request that even the existence of the case be kept secret. The first notice was later withdrawn and replaced with one aimed at British users specifically; Apple's first challenge was dismissed for a change in circumstances and it filed a fresh one in 2026. As this is written the lawfulness question is undecided and the feature is still unavailable, more than eighteen months on.

Note what changed in the shape of the fight. Clipper was a public proposal, argued in the open, and it lost. A technical capability notice is secret by statute, and the outcome so far was decided not by a court but by a company's choice about which market to withdraw a feature from.

## What a practitioner should take from it

**The question is never "should the authorities have access".** It is "what does the system look like once the access exists", and that is an engineering question with an answer that does not depend on who is asking. Every debate in this catalogue about who can compel a supplier - the [Quad9 court order](https://ronutz.com/en/industry/quad9), the [Starlink terms of service](https://ronutz.com/en/industry/spacex), the [Crypto AG ownership](https://ronutz.com/en/industry/crypto-ag) - is the same question in a different jurisdiction.

**Classified components cannot be trusted components.** Skipjack was probably a decent cipher. It failed because nobody could check, and the industry has since settled firmly on the opposite principle: the algorithm is public, the key is secret, and anything that inverts that arrangement is treated as a defect. That is why the [named TLS attacks](https://ronutz.com/en/learn/the-named-tls-attacks) were found - the specifications were readable by the people who found them.

**And the argument is not over.** Anyone who learned this history as a story about the 1990s should notice that the current round involves a secret order, a live tribunal case, and a major encryption feature already withdrawn from an entire country. The thing this site's tools protect exists because a particular argument was won repeatedly, and it is being had again.

## Sources

- [Electronic Frontier Foundation, on the Clipper Chip's birthday: the Clinton White House introduced it in 1993 as a plan for hardware backdoors, giving law enforcement the ability to decrypt traffic; key escrow met massive public opposition and Clipper's security was shown to be flawed by researchers including Matt Blaze; by 1996 the proposal was dead](https://www.eff.org/deeplinks/2015/04/clipper-chips-birthday-looking-back-22-years-key-escrow-failures)
- [Matt Blaze, "Protocol Failure in the Escrowed Encryption Standard", AT&T Bell Laboratories, 20 August 1994: the paper evaluates the EES protocols and demonstrates that it is possible to communicate without transmitting a valid Law Enforcement Access Field, undermining the key escrow mechanism](https://www.scribd.com/document/838294774/protocol-fail)
- [Matthew Green, A history of backdoors: Blaze discovered that it was possible, with considerable effort, to use the chip's encryption while bypassing the mechanism that escrowed the key; nothing in the paper questioned the security the chip offered, as the paper candidly admitted, and the press largely ignored that caveat](https://blog.cryptographyengineering.com/2015/07/20/a-history-of-backdoors/)
- [John Kasdan, Columbia Institute for Tele-Information, 1994: the Clipper chip was announced by White House press release on 16 April 1993; a tamper-proof chip produced by Mykotronx, incorporating the classified SKIPJACK algorithm and a unit key split into two shares; SKIPJACK was pointedly not made generally available for evaluation, raising fears of a trap door](https://business.columbia.edu/sites/default/files-efs/imce-uploads/CITI/Working%20Papers/Working%20Papers%20M/Manfatory%20Escrow%20Schemes%20Law%20and%20Politics.pdf)
- [Exabeam: the cryptographic community objected that Skipjack could not be publicly evaluated; AT&T Bell produced the first and only telephone device based on the chip in 1993, and by 1996 the chip was no more](https://www.exabeam.com/blog/infosec-trends/the-clipper-chip-how-once-upon-a-time-the-government-wanted-to-put-a-backdoor-in-your-phone/)
- [Jones Walker, from Clipper Chips onward: after the 2015 San Bernardino shooting the FBI obtained an All Writs Act order directing Apple to build a custom operating system to bypass iPhone encryption; the Clipper precedent was that weakening security architecture for one purpose weakens it for all purposes](https://www.joneswalker.com/en/insights/blogs/ai-law-blog/from-clipper-chips-to-claude-a-history-of-government-power-vs-technology-safety.html?id=102mlj8)
- [Privacy International, the Apple technical capability notice challenge: Apple withdrew Advanced Data Protection for new UK users weeks after the notice was leaked; in April 2025 the Investigatory Powers Tribunal issued a public judgment rejecting the government's position that nothing about the case should be public; in July 2025 it directed the parties to agree assumed facts for a seven-day open hearing; in October 2025 the first notice was reported withdrawn and replaced with one targeting British users](https://privacyinternational.org/legal-action/pi-apple-tcn-challenge)
- [Digital Freedom Fund: the notice was issued under the Investigatory Powers Act 2016 and reportedly required a back door into iCloud reaching end-to-end encrypted data of users anywhere; Apple withdrew its advanced data protection service for UK users and challenged the notice; after the first notice was withdrawn and replaced, Apple's first challenge was dismissed for a change in circumstances and a second was brought](https://digitalfreedomfund.org/uk-government-forcing-apple-to-break-encryption/)
- [On the state of the case: Advanced Data Protection has been unavailable to new UK users since February 2025 under a section 253 notice; Apple confirmed a new complaint at the Investigatory Powers Tribunal in August 2026 and the lawfulness question remains undecided](https://cunicula.com/en/articles/uk-apple-adp-technical-capability-notice)