There is a significant risk that widespread insertion of government-access key recovery systems into the information infrastructure will exacerbate, not alleviate, the potential for crime and information terrorism. Increasing the number of people with authorized access to the critical infrastructure and to business data will increase the likelihood of attack, whether through technical means, by exploitation of mistakes or through corruption. Furthermore, key recovery requirements, to the extent that they make encryption cumbersome or expensive, can have the effect of discouraging or delaying the deployment of cryptography in increasingly vulnerable computing and communications networks. The predictable costs and risks of key recovery, particularly when deployed on the scale desired by law enforcement, are very substantial. The onus is on the advocates of key recovery to make the case that the benefits outweigh these substantial risks and costs.
Key recovery lets encrypted communications be read by an authorized third party.
As described in the previous sections , governments are powerfully motivated to be able to intercept communications in order to help control crime and protect their national security. The uncontrolled, widespread deployment of strong encryption significantly prevents them from achieving this goal. Since the release of PGP , the US, UK, and other governments have invested a lot of effort in trying to put the encryption cat back in the bag, which can be done through implementation key recovery systems. The requirements for release of these keys varies from country to country, from almost no oversite at all, to the requirement to obtain a court order from a judge. Naturally, key recovery is a controversial issue, pitting the needs of the national community against the rights of the individual.