One argument, four rounds

A government wants lawful access to communications. Cryptographers reply that a system built to be readable by an authorised party is a system built to be readable, and that the authorisation is a policy which can change while the readability is a property of the design which cannot. That exchange has now run for thirty-three years without either side conceding, and its four rounds - export control, , the standards backdoor, and the present fight over cloud encryption - are usually told separately. They are one story, and a practitioner meets its residue constantly: in cipher suites named "export", in a key length that stayed at 56 bits for two decades, in the design decision to hold keys on a device rather than a server.

The encryption family history covers the first round from the algorithm's side, and the EFF article covers the litigation that ended it. This is the policy arc, and the middle rounds.

16 April 1993: the chip

The Clinton White House announced it by press release: a tamper-resistant chip, officially the MYK-78 and universally the Clipper Chip, to be built into secure telephones. The encryption was genuinely strong - an algorithm called Skipjack, designed by the National Security Agency (NSA). The bargain was in the key. Each chip's unit key was split into two shares, held by two separate escrow agencies, which law enforcement with the appropriate authorisation could obtain and recombine. Every encrypted call also carried a Law Enforcement Access Field (LEAF), which contained the session key wrapped under that unit key, so that a recovered unit key unlocked the traffic.

Two objections arrived immediately and they were different in kind. The first was civil-liberties and political, and it produced an unusually broad coalition - technologists, privacy advocates and industry, joined by politicians across the spectrum. The second was narrower and more damaging: Skipjack was classified. It could not be evaluated by the public, and a small group of cryptographers shown it under agreement could not publish. A cipher nobody may examine cannot be trusted by the people asked to depend on it, whatever its actual quality - which is the argument this catalogue's RSA entry records being made again about a random-number generator a decade later.

Then, in August 1994, Matt Blaze of AT&T Bell Laboratories published "Protocol Failure in the Escrowed Encryption Standard", and here the record deserves more care than it usually gets. Blaze did not break Skipjack. What he showed was that a determined user could communicate through a Clipper device without transmitting a valid LEAF - obtaining the encryption while defeating the escrow. He said as much in the paper. The popular shorthand, that Blaze found "security flaws in Clipper", is not quite what happened and the distinction matters: the escrow mechanism, not the cipher, was the fragile part, and the people the scheme was aimed at were exactly the people willing to do the extra work to bypass it. A criminal could have strong encryption without escrow; an ordinary citizen would have escrow by default.

AT&T built one telephone using the chip. It was the only product that ever shipped with it. By 1996 the proposal was dead.

Why escrow keeps losing on engineering grounds

The recurring argument is not that governments have no legitimate interest. It is that exceptional access is a structural change to a system rather than a permission added to it.

A system with a mechanism for authorised decryption has that mechanism whether or not the authorisation is present. The mechanism must be implemented in every device, maintained across every version, and protected in transit and at rest; the escrow database becomes a single target holding the keys to everything the scheme covers; and the access path must itself be authenticated, which means the security of the whole system now rests on the security of a process rather than on mathematics. The Nortel entry records a company whose credentials were taken and which changed passwords without evicting the intruder; the Ericsson entry records a lawful-interception subsystem present in a switch while the auditing subsystem was not purchased, and a year of tapped calls that nobody noticed. Both are exceptional access working exactly as designed, for someone else.

The sequel, 2013 to now

The proposal died; the goal did not.

In 2013 the Snowden disclosures showed that while the public argument had been about escrow, the NSA had been pursuing the same end quietly - through the standards process, as the Dual_EC_DRBG story records, and through the fibre-tap infrastructure the spent sixteen years litigating over. The response from industry was not a policy position but a build: encryption became a default in consumer messaging, and phones began holding keys the manufacturer could not produce.

That produced round three. After the 2015 San Bernardino shooting, the FBI obtained a court order under the All Writs Act directing Apple to build a version of its operating system that would let the Bureau a locked iPhone. Apple refused, arguing that the software did not exist, that building it would create a capability that could be demanded again, and that the demand was legislative in nature and belonged in a legislature. The case ended without a ruling when the Bureau found another way in, which left the legal question exactly where it had been.

Round four is running now, and it is the one to watch because it is the first where a government has largely got what it asked for. In January 2025 the United Kingdom's Home Office issued Apple a technical capability notice under section 253 of the Investigatory Powers Act 2016 - a secret order, which the recipient may not disclose - reportedly requiring the capability to access iCloud data protected by Advanced Data Protection, Apple's end-to-end encryption option. Apple did not build it. In February 2025 it withdrew the feature from the United Kingdom instead, so that British users now have less protection than users elsewhere. Apple and, separately, Privacy International and Liberty went to the Investigatory Powers Tribunal, which in April 2025 refused the government's request that even the existence of the case be kept secret. The first notice was later withdrawn and replaced with one aimed at British users specifically; Apple's first challenge was dismissed for a change in circumstances and it filed a fresh one in 2026. As this is written the lawfulness question is undecided and the feature is still unavailable, more than eighteen months on.

Note what changed in the shape of the fight. Clipper was a public proposal, argued in the open, and it lost. A technical capability notice is secret by statute, and the outcome so far was decided not by a court but by a company's choice about which market to withdraw a feature from.

What a practitioner should take from it

The question is never "should the authorities have access". It is "what does the system look like once the access exists", and that is an engineering question with an answer that does not depend on who is asking. Every debate in this catalogue about who can compel a supplier - the Quad9 court order, the Starlink terms of service, the Crypto AG ownership - is the same question in a different jurisdiction.

Classified components cannot be trusted components. Skipjack was probably a decent cipher. It failed because nobody could check, and the industry has since settled firmly on the opposite principle: the algorithm is public, the key is secret, and anything that inverts that arrangement is treated as a defect. That is why the named TLS attacks were found - the specifications were readable by the people who found them.

And the argument is not over. Anyone who learned this history as a story about the 1990s should notice that the current round involves a secret order, a live tribunal case, and a major encryption feature already withdrawn from an entire country. The thing this site's tools protect exists because a particular argument was won repeatedly, and it is being had again.

Sources