End-to-End Encryption and Law Enforcement Access to Data Can Coexist, Justice Official Says

SAN FRANCISCO — Tech companies could provide keys to decrypt information to third-party entities, a senior Justice official said, describing one way the private sector might enable law enforcement’s warranted access to encrypted data for criminal investigations while preserving privacy under a legal framework.

“I believe they can coexist,” John Demers, assistant attorney general for national security, told reporters Monday ahead of the RSA cybersecurity conference. Demers challenged a broadly-held belief among privacy advocates that it is impossible to retain end-to-end encryption for cybersecurity while allowing law enforcement special access to the coded data.

As Justice officials stress they need access to investigate egregious crimes such as child sexual exploitation and trafficking, opponents say there is no “technical solution” to allow law enforcement in without undermining everyone’s privacy.

One solution could be escrowed encryption, where a third party holds the decryption keys. A Cisco-certified expert blog on the issue argues human reasons, more than technical or legal ones are why escrowed encryption is largely unworkable. The scenario raises big unanswered questions: which encryption keys should be put in escrow, what entities should act as trusted third parties, can the security for the database of decryption keys be ensured or would the database be vulnerable to bribable employees? 

Demers acknowledged some people say law enforcement access and end-to-end encryption “can’t coexist,” but pointed to laws established in Australia and the United Kingdom as examples of how he said other countries are getting ahead of the U.S. on the issue. 

In Australia, government agencies can issue notices or requests to the employees of communications providers compelling them to use or build an “interception capability.” The U.K. law makes it lawful for organizations or public bodies to intercept communications for national security, and preventing or detecting a crime, among other purposes.

Demers comments lent some clarity to Justice’s position on end-to-end encryption, which FBI Director Christopher Wray seemed to reject as a whole during a hearing before the House Judiciary Committee earlier this month.

“I don't mean to suggest that there should be some encryption that's very encrypted, and something that's less encrypted or anything like that,” Demers said when asked specifically about end-to-end encryption. “What I mean to say is everything should be strongly encrypted but there should be a way for the government to get access to that data with a court order.”

He added Justice understands the desire of entities like the Defense Department to secure their networks and the communications of their personnel and said that’s why Justice supports a flexible approach. 

“We don't want to mandate the solution, whether its a key escrow system or something else,” Demers said, referring to the third-party method for addressing the encryption challenge. 

“What we want to do is more of the U.K. approach,” he said. “If we're going to have a mandate then it would be more of a requirement, and then individual companies can come up with whatever solution best meets that requirement while allowing them to keep the data secure.”

Tech companies have said allowing law enforcement access to encrypted data would put them at a competitive disadvantage against other tech companies around the world who refuse such access. Demers said the developments in Australia and the U.K. nullify that argument.

“If the competitors are in these other countries — a lot of them are European — then there isn't going to be a competitive disadvantage for American companies, if they're also required to have some sort of solution, and that's a plus,” he said. “Obviously we don't want to put industry at a competitive disadvantage. Seeing the international consensus form around this issue is interesting and that is different from where we were five or six years ago.”