THE METAPHOR IS THE KEY: CRYPTOGRAPHY,
THE CLIPPER CHIP, AND THE CONSTITUTION

A. Michael Froomkin

Document information and copyright notice

[Page n] references relate to the pagination of the printed version.

Click here to jump to a specific page:

To table of contents

III. Would Mandatory Key Escrow Be Constitutional?

With a mandatory key escrow statute of this type, the government would be asking all citizens to surrender their collective right to technical countermeasures to the "progress of science in furnishing the Government with means of espionage."{430} Mandatory key escrow could use a hardwired chip key like Clipper, or it could be implemented through software designed to resist tampering by the user.{431} Would such a statute be constitutional?

This Part provides a whirlwind survey of relevant First, Fourth, and Fifth Amendment doctrines, as well as evolving conceptions of the constitutional right to privacy. The focus is analytic and predictive, rather than prescriptive. This Part attempts to sketch how courts, given the current state of the law, would be likely to rule on the constitutionality of a mandatory key escrow statute. It suggests that mandatory key escrow would reduce associational freedoms, chill speech, and constitute an intrusive search. The statute also might require a form of self-incrimination and would infringe personal privacy rights. Under existing doctrines, however, the analysis of the constitutionality of mandatory key escrow legislation would turn on the court's balancing of the potential costs to personal privacy against the perceived gains for law enforcement and national security. On balance, private, noncommercial users of encryption probably have a Fourth Amendment right to resist mandatory key escrow and might have a First Amendment claim as well. Whether commercial users or corporations would have such [Page 812] rights under current doctrines is less clear. Even the vitality of the rights of private noncommercial users appears to be a distressingly close question given the current state of civil rights doctrine and the great importance courts accord to law enforcement and national security. A description of a more holistic, less myopic, view of the issue, as well as most recommendations, are deferred until Part IV.

The volume of relevant constitutional doctrine imposes a greater and more harmful constraint on this discussion than the need to summarize ruthlessly and put off (most) prescriptions until Part IV. Even though constitutional cases establishing a right to some form of privacy recognize that the right is grounded in the First, Fourth, and Fifth Amendments,{432} the four areas remain doctrinally distinct. Reflecting this separation for ease of exposition risks survey at the price of synergy and synthesis. It is important to remember that this is an area in which the whole is, or at least should be, greater than the sum of its clause-bound parts.

A. First Amendment Issues

Mandatory key escrow affects public debate in three ways. First, mandatory key escrow forces users of cryptography to disclose [Page 813]something they would prefer to keep secret, which amounts to compelled speech. Second, it chills speech by persons who seek to remain either secure or anonymous when speaking, whether for fear of retribution or other reasons. Third, it chills the associational freedom of persons who wish to band together but do not wish to call attention to the fact of their association or to their participation in a known association.

1. Compelled Speech

[Page 814]Mandatory key escrow differs from the issues in the leading mandatory disclosure cases{441} because the disclosure is not public. Instead, the government says it will keep the chip key secret and will decrypt the LEAF only for good cause. The Supreme Court has stated that mandatory disclosure laws will be sustained only if there is "a `relevant correlation' or `substantial relation' between the governmental interest and the information required to be disclosed."{442} If the state interest in telling donors how charities use their contributions is sufficient to justify a mandatory disclosure statute,{443} then the state interest in crime fighting and national security should be sufficiently compelling too.{444} Because the government keeps the key in escrow, the rule is more narrowly tailored than a public disclosure rule.{445} The critical question therefore is whether the burdens--forcing the user to utter a LEAF or the equivalent and introducing doubt as to the security of what might otherwise be a completely secure system--are worth the gain to national security and law enforcement. This is a value judgment, one that cannot be settled easily by doctrinal argument, yet one that the courts would have to make to resolve the issue.{446} As with [Page 815]many value judgments, reasonable people may differ on the outcome; the less speculative the claim that harms will flow from allowing promiscuous unescrowed encryption (that is, the more terrorists who have managed to blow things up because they used secure telephones), the more likely the courts would find that the measure passed strict scrutiny insofar as it compels speech.{447}

2. Chilling Effect on Speech

"Few thoughts are more threatening to people who value autonomy than the thought of being constantly watched. . . ."{448}

[Page 816]In practice, the Supreme Court balances the following factors: (1) the extent to which speech is likely to be chilled; (2) the degree to which the prohibition falls unevenly on a particular group as opposed to society at large; and (3) the availability of alternate channels of communication.{451} It seems evident that speech will be chilled, although exactly how much is uncertain.{452} To the extent that the prohibition falls unevenly on society, it will tend to affect those with access to computers and scrambler telephones. This is not the group whose speech the Court traditionally takes the most care to protect, because wealthy and well-educated people have the greatest access to alternative channels of communication.{453} The critical issue is likely to be whether mandatory key [Page 817]escrow "`unduly constrict[s] the opportunities for free expression.'"{454} Because a mandatory key escrow scheme promises to release keys only with just cause, the Court would likely find the constricting effect to be relatively minor. Ultimately, however, the standard collapses into a balancing test in which distinguishing "due" from "undue" content-neutral restrictions requires highly contextual judgments.{455}

3. Anonymity and the Freedom of Association

"[L]ets hold more chat.
In private then.
I am best pleased with that."{456}

Key escrow threatens this anonymity in two ways. First, and of greater significance, it makes it possible for eavesdroppers armed with the escrowed key to identify the ultimate source and actual content of encrypted e-mail messages being sent out to anonymous remailers. Second, key escrow makes it possible for eavesdroppers armed with the escrowed key to identify the person to whom the target of a wiretap is speaking; without the key, the only information gleaned would be call set-up information, which merely identifies the telephone on the other end of the conversation.

In the last thirty years, the Supreme Court has struck down several statutes requiring public disclosure of the names of members of dissident groups,{462} stating that "[i]nviolability of privacy in [Page 819]group association may in many circumstances be indispensable to preservation of freedom of association."{463} Nevertheless, the right to privacy in one's political associations and beliefs can be overcome by a compelling state interest.{464} Thus, the Court held that associational freedoms do not trump the application of statutes forbidding discrimination in places of public accommodation. In so doing, however, the Court reiterated that "the Constitution protects against unjustified government interference with an individual's choice to enter into and maintain certain intimate or private relationships."{465} As the Court stated in Board of Directors of Rotary International v. Rotary Club of Duarte,{466} two key issues affecting the degree of constitutional protection to be afforded to an association are the degree of intimacy and whether the relationship is conducted "in an atmosphere of privacy" or one where the group seeks to "keep their `windows and doors open to the whole world.'"{467} Impediments to the right to choose one's associates, including (presumably) publicity, can violate the First Amendment.{468}

[Page 820]A requirement that group members communicate in a fashion that is accessible to lawful government wiretaps is both less and more intrusive than a requirement that groups publish their membership lists. It is less intrusive because no actual intrusion occurs until and unless a warrant is granted allowing the government to eavesdrop on communications. It is more intrusive because, once the intrusion occurs, specific facts about individuals will be disclosed in addition to the fact of membership in the group. Thus, while a national security/law enforcement justification for a narrowly tailored limit on associational privacy is likely to be at least as compelling as the state's legitimate desire to root out invidious discrimination, the countervailing interests are arguably greater also.

Groups seeking to change the social order in ways likely to be resented by police and others in positions of power will have reason to fear that state actors will find ways to access their keys. Indeed, in Buckley v. Valeo{469} and again in Brown v. Socialist Workers '74 Campaign Committee{470} the Supreme Court recognized that minor political parties may be able to show a "reasonable probability" that disclosure of membership information will subject those identified to "threats, harassment, and reprisals"--including harassment from the government.{471} Ultimately, therefore, the courts again will be left with an essentially nonlegal value judgment: whether the interests supporting mandatory key escrow are sufficiently great to justify the increased risk of harassment to political dissidents.

A challenge to mandatory key escrow as an infringement on the freedom of association would increase its chances of success if the challengers could demonstrate that mandatory key escrow closes off a channel of anonymous communication that has no true alternative.{472} Indeed, no substitute exists for the anonymous remailer: unlike anonymous leaflets, no one can see an e-mail being created, and thanks to the anonymous remailer, no one can see it being distributed, either.

[Page 821]On October 12, 1994 the Supreme Court heard arguments in McIntyre v. Ohio Elections Commission.{473} Like Talley, the McIntyre case concerns the validity of a state statute that imposes a flat ban on distribution of anonymous political campaign leaflets. The decision in McIntyre may have a very significant impact on the law surveyed in this subsection.{474}

4. The Parallel to Antimask Laws

In states with strict liability antimask statutes, demonstrations and all travel by masked persons are illegal. Investigators of racially motivated crimes credit antimask laws for preventing those responsible from traveling in disguise. The prohibition on masked rallies also makes it easier for police to make arrests, after the fact if necessary, when demonstrations become violent.{477} Antimask [Page 822]laws have been justified as a means of helping to prevent violence, but this justification has met with a mixed reception by courts and commentators.{478} The Supreme Court of Georgia accepted that the state interest in preventing crimes of violence and intimidation associated with mask-wearing was sufficiently compelling to justify an incidental infringement on First Amendment rights.{479} On this reasoning, mandatory key escrow would probably pass constitutional muster also. Not everyone agrees, however, that First Amendment guarantees can be compromised merely by reference to the history of violence associated with mask-wearers. Some courts and commentators believe that the First Amendment requires that there be specific evidence that a particular masked person or demonstration presents a threat of violence before an antimask statute can be applied without violating the Constitution.{480}

Perhaps inhibited by the irony of having to rely on NAACP v. Alabama ex rel. Patterson,{481} few Ku Klux Klan challenges to antimask laws have been predicated on the right to associational freedom of mask-wearing travellers and demonstrators. As a result, only one state supreme court and one federal court have ruled on an associational freedom challenge to an antimask law, and they disagreed.{482} The constitutionality of antimask laws remains [Page 823]largely unsettled, suggesting that the First Amendment aspects of mandatory key escrow would present an equally close and disputed question.

B. Fourth Amendment Issues

Americans already acquiesce to substantial invasions of privacy by government fiat, without a warrant. We disclose personal details of our lives on tax returns. We consent to having our belongings x-rayed, opened, and searched as our persons are scanned for metal (sometimes followed by a pat-down) as a condition of being allowed to board an airplane or enter some public buildings. The law says the government may paw through a citizen's garbage without a warrant,{484} and that she lacks a reasonable expectation of privacy in relation to telephone numbers dialed.{485} The police may fly over her house in a helicopter at four hundred feet{486} and use special cameras to photograph everything below.{487} The government may [Page 824]use satellites to spy in her windows;{488} it may use heat-detection gear to monitor heat emanations from her home;{489} it may use dogs to sniff her luggage and her person.{490} Once the government has arranged for an informant to plant a beeper on a citizen, the government may use the signal to track the citizen's movements.{491} When national security is at risk, many procedural [Page 825]protections that are required in the ordinary course of an investigation are suspended. For example, the government may, for reasons of national security, break into some premises without a warrant to plant a bug, whereas the same action in an ordinary criminal investigation would require a warrant.{492} National security wiretap requests go to a secret court that meets in camera and never issues opinions.{493}

On the other hand, mandatory key escrow differs from each of these examples in significant ways, especially as it affects private, noncommercial use. Absent exigent circumstances such as fires, hot pursuit, or the like, the Supreme Court has yet to approve a [Page 826]warrantless intrusion into a home occupied by an ordinary taxpayer, much less one who has made efforts to shield herself from detection.{494} Except for consent to x-rays and searches at airports and public buildings, none of the examples above require the target of the probe to take any action to aid the prober, much less to ensure that the probe is successful; and this exception does not reach into the home.

In principle, warrants are required for all domestic security wiretaps.{495} The next subsections describe how the Fourth Amendment also prohibits warrantless mandatory key escrow for private, noncommercial uses of encryption.{496} Commercial and corporate uses, however, present a more difficult question. These uses may not be entitled to Fourth Amendment protection against mandatory key escrow.

1. The Fourth Amendment Does Not Give the Government an Affirmative Right to an Effective Search

The absence in the Fourth Amendment of an affirmative grant of power to make effective searches, however, does not determine whether the affirmative grants in Articles I and II give the government the power to subject communications to nonconsensual searches. It simply means that from a Fourth Amendment perspective, mandatory key escrow poses strictly traditional problems: Is mandatory key escrow, which takes place without a warrant, a search and seizure?{500} If so, is it a reasonable warrantless search or seizure, or should a warrant be required?

2. Mandatory Escrow of a Key Is a Fourth Amendment "Search or Seizure"

Not every acquisition of information by the government from sources reasonably expected to be private is necessarily a search. For example, the Supreme Court has held that unintrusive means of piercing personal privacy, such as overflights{503} or the use of dogs to sniff for contraband,{504} are not searches for Fourth Amendment purposes. Although wiretapping is also unobtrusive, there has been no question since Olmstead v. United States{505} was overturned{506} that wiretapping constitutes a Fourth Amendment search or seizure.

Not every search affecting matters reasonably expected to be private requires a warrant. Examples of legitimate warrantless searches include "regulatory searches,"{507} searches incident to valid arrests,{508} searches conducted under exigent circumstances (such as the likely destruction of evidence),{509} and border search[Page 829]es.{510} Absent a specific national security rationale directly related to the conversation, the speaker, or exigent circumstances, however, a warrant is required for a wiretap both under the Fourth Amendment and under Title III.{511}

A key is not itself a conversation, however, but the means to decrypt one. Nevertheless, there should be no doubt that absent government action to force disclosure, a properly guarded key to a cryptographic system would be an item of information for which the user would have both a subjectively and objectively reasonable expectation of privacy.{512} Indeed, the entire point of having a cryptographic system is to increase or create privacy. This is especially true in a public-key cryptographic system, in which the private key is never disclosed.{513} A requirement that keys (or the means to decrypt them) be turned over to the government is thus clearly a search or seizure for Fourth Amendment purposes.

The Fourth Amendment regulates both the issuance of search warrants and the conduct of a valid search. Key escrow seeks to preserve the government's ability to carry out a valid search by taking action in advance of any warrant.

One can imagine many actions that the government might take to preserve its ability to conduct valid searches. It might, for example, require all citizens to live in glass houses by prohibiting the use of any other building material. More reasonably, the government might prevent banks from renting out safe deposit boxes that would destroy the contents unless opened with the right key. Or, the government might prohibit the construction of homes with armored walls. Each of these hypothetical rules might raise constitutional problems, but none of them is in itself a search.

[Page 830]In contrast, a key is information that the government forces the user to disclose. This distinguishes key escrow from other, closely related, hypothetical situations in which the government might make preemptive rules designed to make the execution of a valid search warrant easier. The dissimilarity is, however, nothing more than a weak and unreliable distinction between requiring an act and proscribing alternatives to that act. The question then becomes whether this search or seizure falls into any of the classes of exceptions to the warrant requirement.

3. Mandatory Key Escrow as a "Regulatory Search"

The leading regulatory search case is National Treasury Employees Union v. Von Raab,{515} in which the Supreme Court endorsed a [Page 831]Customs Service program of mandatory employee drug testing.{516} The Court stated that "neither a warrant nor probable cause, nor, indeed, any measure of individualized suspicion, is an indispensable component of reasonableness in every circumstance."{517} Instead, "where a Fourth Amendment intrusion serves special governmental needs, beyond the normal need for law enforcement," one should "balance the individual's privacy expectations against the Government's interests to determine whether it is impractical to require a warrant or some level of individualized suspicion in the particular context."{518}

It is difficult to imagine a case in which the government would find it easier to plead "special needs," such as the need to prevent the development of "hidden conditions" and the impracticality of warrants for every key,{519} than in its attempt to compile a database of chip keys or session keys.{520} Mandatory key escrow fits several of the criteria enunciated in Von Raab. In particular, mandatory key escrow is not designed to produce evidence for criminal prosecutions (wiretaps do that, but they require warrants or other authorization), but rather to deter crimes that might otherwise be furthered by the use of encryption.{521} The key's owner knows that the key is being escrowed. In addition, if encryption becomes widespread, a more particularized approach would be difficult if not impossible.{522} Finally, because the government only plans to use the key segments for legitimate searches, it can argue that the cost to personal privacy is low.{523}

[Page 832]On the other hand, although the courts have allowed warrantless regulatory searches in the workplace, at airports, in prisons, at the border, and in schools, none of the leading regulatory search cases has involved a search that entered into the home, unless the home was the scene of a fire or was occupied by a parolee, probationer, or welfare recipient.{524} Indeed, in Camara v. Municipal Court{525} the Supreme Court refused to eliminate the warrant requirement for routine searches that penetrated residential property hunting for violations of the city's housing code.{526} The Court characterized the housing inspectors' intrusions into the home as too "significant" to be allowed without a warrant{527}--although the same Court then went on to balance the interests at stake and concluded that warrants could be issued with a lesser showing of need than that traditionally required for probable cause.{528}

Mandatory key escrow would affect many different types of users, including both business and personal users who send messages both commercial and political. The regulatory search precedents, particularly Von Raab, suggest that Congress might be able to require mandatory key escrow for businesses and other commercial users without implicating the Fourth Amendment as it is currently understood. The broad sweep of the special needs justification, however, is not easily confined to the market sector of society, and there is nothing in the logic of Von Raab that requires it remain there.

Although the Court decided Wyman v. James{529} after Camara, to date the Court has not extended the special needs justification of Von Raab into the home. This suggests that private, noncommercial [Page 833]users of encryption might not fall within any of the currently specified special needs categories of the regulatory search exception to the Fourth Amendment. As currently understood, therefore, the Fourth Amendment probably prohibits warrantless mandatory key escrow, at least for private, noncommercial users of encryption.{530}