Crypto Wars
[1] In the early days of the Cold War, the U.S. and its allies developed an elaborate series of export control regulations designed to prevent a wide range of Western technology from falling into the hands of others, particularly the Eastern bloc.
Since in the immediate post WWII period the market for cryptography was almost entirely military, the encryption technology (techniques as well as equipment and, after computers became important, crypto software) was included as a Category XIII item into the United States Munitions List.
By the 1960s, however, financial organizations were beginning to require strong commercial encryption on the rapidly growing field of wired money transfer.
Generally these were dealt with through case-by-case export license request proceedings brought by computer manufacturers, such as IBM, and by their large corporate customers.
Phil Zimmermann's PGP cryptosystem and its distribution on the Internet in 1991 was the first major 'individual level' challenge to controls on export of cryptography.
[2] Shortly afterward, Netscape's SSL technology was widely adopted as a method for protecting credit card transactions using public key cryptography.
The longest key size allowed for export without individual license proceedings was 40 bits, so Netscape developed two versions of its web browser.
This order permitted the United States Department of Commerce to implement rules that greatly simplified the export of proprietary and open source software containing cryptography, which they did in 2000.
[8] For instance, the BIS must be notified before open-source cryptographic software is made publicly available on the Internet, though no review is required.
Security researcher Ross Anderson reported in 1994 that "there was a terrific row between the NATO signal intelligence agencies in the mid-1980s over whether GSM encryption should be strong or not.
The Germans said it should be, as they shared a long border with the Warsaw Pact; but the other countries didn't feel this way, and the algorithm as now fielded is a French design.
The successful cracking of DES likely helped to gather both political and technical support for more advanced encryption in the hands of ordinary citizens.
By 2010, the Edgehill program, the British counterencryption effort, was unscrambling VPN traffic for 30 targets and had set a goal of an additional 300.
[24] Even though Dual_EC_DRBG was known to be an insecure and slow random number generator soon after the standard was published, and the potential NSA backdoor was found in 2007, and alternative random number generators without these flaws were certified and widely available, RSA Security continued using Dual_EC_DRBG in the company's BSAFE toolkit and Data Protection Manager until September 2013.
[33][34] Various law enforcements officials, including the Obama administration's Attorney General Eric Holder[35] responded with strong condemnation, calling it unacceptable that the state could not access alleged criminals' data even with a warrant.
In one of the more iconic responses, the chief of detectives for Chicago's police department stated that "Apple will become the phone of choice for the pedophile".
In April 2016, Dianne Feinstein and Richard Burr sponsored a bill, described as "overly vague" by some,[44] that would be likely to criminalise all forms of strong encryption.
[47] District Attorney Cyrus Vance Jr., Professor Matt Tait, Erik Neuenschwander from Apple, and Jay Sullivan from Facebook testified.
"[48] In October 2017, Deputy Attorney General Rod Rosenstein called for key escrow under the euphemism "responsible encryption"[49] as a solution to the ongoing problem of "going dark".
[50] This refers to wiretapping court orders and police measures becoming ineffective as strong end-to-end encryption is increasingly added to widespread messenger products.
Rosenstein suggested key escrow would provide their customers with a way to recover their encrypted data if they forget their password, so that it is not lost forever.
From a law enforcement perspective, this would allow a judge to issue a search warrant instructing the company to decrypt the data; without escrow or other undermining of encryption it is impossible for a service provider to comply with this request.
[53] However, the attempt to have those ciphers standardized by ISO failed because of severe criticism raised by the board of cryptography experts which provoked fears that the NSA had non-public knowledge of how to break them.
[54] Following the 2015 Charlie Hebdo shooting, a terrorism attack, former UK Prime Minister David Cameron called for outlawing non-backdoored cryptography, saying that there should be no "means of communication" which "we cannot read".
