...In the most alarming example, Phil Zimmermann spent years battling federal arms exporting charges over his PGP encryption suite. The threat of force was real, and resisting it took real sacrifice...

There's a bill called CALEA II that would mandate exactly the kind of backdoor Comey wants.

The 1994 Communications Assistance for Law Enforcement Act (CALEA) mandated that phone companies install remote wiretapping ports into their central office digital switches, creating a new technology infrastructure for "point-and-click" wiretapping, so that federal agents no longer have to go out and attach alligator clips to phone lines. Now they will be able to sit in their headquarters in Washington and listen in on your phone calls. Of course, the law still requires a court order for a wiretap. But while technology infrastructures can persist for generations, laws and policies can change overnight. Once a communications infrastructure optimized for surveillance becomes entrenched, a shift in political conditions may lead to abuse of this new-found power. Political conditions may shift with the election of a new government, or perhaps more abruptly from the bombing of a federal building.

Dear Microsoft Internet Explorer Customer:

RE: Microsoft Internet Explorer 3.0 128-bit Encryption Version
(FOR DISTRIBUTION IN U.S. AND CANADA ONLY)

This version of Microsoft Internet Explorer 3.0 enables 128-bit SSL encryption between Microsoft Internet Explorer and a compatible internet server. 128-bit data encryption capability exceeds the export control threshold the U.S. Government has set for the technology, therefore this product is distributed by Microsoft within the U.S. and Canada ONLY. Export of this product from the United States to any foreign destination is regulated by the International Traffic in Arms Regulations (ITAR, 22 CFR 120-130). Users should not export or re-export this product to any country, other than Canada, or to any person, entity or end user subject to U.S. export restrictions without first obtaining an export license from the U.S. State Department, Office of Defense Trade Controls.

Users are advised to consult legal counsel or the State Department to determine whether any particular use or distribution of an ITAR-restricted product might be considered an "export" under ITAR. The definition of "export" under U.S. export law may include many distribution scenarios that are not immediately obvious, such as providing a restricted product on a network server accessible to users located outside the U.S. or Canada. Since fines and penalties could be levied under U.S. export law against companies or individuals involved in any transaction that allows ITAR-restricted products outside the U.S. and Canada, we suggest that users take special care to re-distribute this product only in compliance with U.S. export law.

Can I send or carry ITAR-restricted products to Canada?
There is an exemption under ITAR for the export of ITAR-restricted products to Canada for use there by Canadian citizens (22 CFR 126.5). Shipment of an ITAR-restricted product to Canada may require filing of a Shippers Export Declaration (SED). For more information on ITAR exports to Canada consult legal counsel or the U.S. State Department, Office of Defense Trade Controls PH (703) 875-6644.

Can I carry ITAR-restricted products with me when I travel outside the U.S.?
There is an exemption under ITAR for the temporary export of cryptographic products like Microsoft Internet Explorer 3.0 128-bit Encryption Version for personal use by U.S. citizens and lawful permanent residents who have the need to temporarily export cryptographic products when leaving the U.S. for brief periods of time (22 CFR 123.27). The exemption does not require an export license or SED, however it does require that the traveller keep certain records and report instances where the product may be stolen or otherwise compromised, in addition to other requirements and restrictions. Please contact the Office of Defense Trade Controls for details.

Can I send ITAR-restricted products anywhere else?
At present the State Department may allow limited export of some ITAR-restricted products under specific export license to foreign subsidiaries of U.S.-based corporations ONLY. There are significant restrictions on such exports. Please contact the Office of Defense Trade Controls for details.

How do I know whether a Microsoft product is ITAR-restricted?
Microsoft products that are ITAR-restricted carry a special statement on their retail cartons and carrier media: "U.S. State Department license required to export this product from the United States or Canada."

Why is this an issue today?
In the past, all versions of Microsoft products used the same, exportable level of data encryption, and the ability to send U.S. versions to almost any overseas destination was seldom an export issue. In 1992, the U.S. Government fixed the data encryption export control threshold at "40-bits" and since then any product that employs encryption stronger than the 40-bit threshold is technically and legally a munitions under US export law and cannot easily be exported except to Canada. The 40-bit export threshold has not changed in 4 years, but the security requirements of our customers have. The encryption in Microsoft Internet Explorer 3.0 128-bit Encryption Version is considerably stronger than the 40-bit export control threshold. Microsoft cannot provide the stronger encryption version of this product to all users, but we can supply the strong encryption versions to most U.S. and Canadian users, who are allowed to receive them under U.S. export law.

What is Microsoft's position on export controls?
We believe that encryption key lengths must be lengthened substantially from the 40-bit level to provide our worldwide customers strong security and privacy, and to relieve the legal burdens on customers in North America who simply choose to use products with strong encryption capabilities within the U.S. or Canada. We are working actively with other companies in our industry and the Business Software Alliance http://www.bsa.org to encourage the U.S. government to relax its restrictions on export controls.

Yours sincerely,

The Microsoft Internet Explorer Team

In the three cases The Intercept was able to examine, cell-phone evidence had nothing to do with the identification or capture of the culprits, and encryption would not remotely have been a factor.

...a reporter asked for examples of crimes that had been actually averted due to phone data that might in the future be encrypted...

Rescuing someone before they're harmed? Someone in the trunk of a car or something? I don't think I know - yet? I've asked my folks just to canvas - I've asked our state and local partners are there some examples where this - I think I see enough, but I don't think I've found that one yet. I'm not looking. Here's the thing. When I was preparing the speech, one of the things I was inclined to talk about was - to avoid those kids of sort of 'edge' cases because I'm not looking to frighten people. Logic tells me there're going to be cases just like that, but the theory of the case is the main bulk of law enforcement activity. But that said I don't know the answer. I haven't found one yet.

Federal Bureau of Investigation director James B. Comey is not over with his anti-encryption litany...

In a speech delivered to an audience at the Brookings Institute in Washington D.C., Comey once again warned the public that Apple and Google are enabling pedophiles, kidnappers, terrorists and all sorts of violent criminals and are leading us all to "a very dark place."

Tor is the brainchild of the U.S. government. In fact, Tor was invented with the support of the U.S. Naval Research Laboratory, located near Washington, D.C., in suburban Maryland, just inside the Beltway. And yes, this is pretty close to the NSA, which is also located in suburban Maryland, although it's outside the Beltway. - See more at: http://www.eweek.com/security/tor-puts- ... lpaW8.dpuf

Have we become so mistrustful of government and law enforcement in particular that we are willing to let bad guys walk away, willing to leave victims in search of justice?

Rename chips
Put in phones
Tell customers "You haz encryption".
Profit!!!

FBI director: Tech companies should be required to make devices wiretap-friendly.