Last week Stewart Baker posted a mini-op-ed over at the Volokh Conspiracy that he had contributed to a debate hosted by the New York Times about Apple’s plans to encrypt the data on most iPhones, making it impossible for Apple to give law enforcement (or anyone else) access to the phone with or without a search warrant. The technology that Apple intends to use would scramble all data on the phone so that only the owner of the phone could decrypt it. (Google is rolling out similar measures.)

Stewart Baker’s main criticism of this plan is simple: Encryption is a bad idea if you care about enforcing the law:

Most Americans believe in privacy from government searches, but not for criminals. The Constitution protects a citizen’s “houses, papers and effects” only until a judge finds probable cause that the citizen has committed a crime. This year, the Supreme Court ruled that the police need a warrant to search cellphones seized at the time of arrest. But with Apple’s new encryption, probable cause and a warrant will be of little help to the police who seize a suspect’s iPhone and want to search it.
That decision should not be left to Apple alone. And it won’t be.

Baker goes on to argue that companies won’t adopt iPhone technology like this because they need to be able to read their employees’ business communications and enforce regulatory compliance policies. He also points out that the desire to sell iPhones in authoritarian regimes may end up forcing Apple to compromise the security of their phones, ironically, only on behalf of governments that are less respectful of privacy than the United States.

What’s at stake in Apple’s decision? It’s true that defensive encryption has a price. As FBI director James Comey argued last week, the same encryption measures that protect phone data from nosy coworkers also protect it from law-enforcement agents executing a lawful search warrant. In some cases, this may mean that evidence on the phone is totally inaccessible because the phone’s owner refuses to fork over the decryption key. Some investigations and prosecutions would be impaired. In cases involving production of child pornography or terrorism, the costs of device encryption would be significant. In a small number of cases, encryption could make the difference between life and death. In still fewer cases, the consequences could be catastrophic.

But it’s not illegal for Apple to make its phones more secure, and encryption would directly benefit its customers.

An encrypted phone is much less valuable to thieves, who can’t access the information on the phone without the proper authentication. Encryption protects personal data against nosy family members. In a corporate environment, encryption can help prevent confidential business information stored on a stolen phone from being purloined, sold to a competitor, or posted on Scribd.

In addition, the vast majority of smartphone owners aren’t using them for criminal activity. The economic benefits of enhanced data security would be enjoyed broadly by the public. And to deal with the corporate compliance problem that Baker identifies, Apple would probably empower its enterprise customers to retain access to the encryption keys used on company phones.

Finally, there’s a good chance that if Apple’s encryption works well, the means used to defeat the iPhone technology would match up with the importance of the case: Only the national-security agencies would figure out how to defeat iPhone encryption, would guard that knowledge closely, and only deploy it in connection with the most important national-security cases (although with no guarantee of timely success).

Regardless, there are several very bad ways that the government could respond to Apple’s technology. The worst would be regulating encryption. Until January 2000, the government imposed highly restrictive export controls on strong encryption, but the controls couldn’t actually prevent international dissemination of the restricted software. When the Pretty Good Privacy cryptographic software leaked internationally over the Internet in 1991, for instance, the most the government could do was investigate the author of the software. Regulation can only do so much.

Another bad option would be mandating government-accessible backdoors for telecommunications devices. The government tried to do this back in 1993 with a cryptographic device called the Clipper Chip, but the project was highly unsuccessful. Not only does it technically weaken the encryption in which it is deployed, it undermines confidence in the integrity of the technology because it reminds the user that the U.S. government might listen in. Imposing a Clipper-type mandate on Apple would devastate sales of iPhones, especially internationally.

Apple could also voluntarily create a secret backdoor that it keeps in a case labeled “Break Glass In Case of Jack Bauer,” although then Apple couldn’t claim to be unable to unlock iPhones, which defeats the purpose of creating the encryption in the first place.

In the meantime, security researchers will bang away at Apple’s crypto in search of a way to decrypt its phones. If they find a way, such a technical solution would solve most of the problems above. But there’s no guarantee that researchers will find such a vulnerability. In short, there’s no attractive alternative to the impunity that the encryption technology will create. It’s a brave new world.