The widespread use of encryption has triggered a new step in many\u00a0criminal investigations: The encryption workaround. We define an encryption\u00a0workaround as any lawful government effort to reveal unencrypted\u00a0plaintext of a target\u2019s data that has been concealed by encryption. This\u00a0Article provides an overview of encryption workarounds. It begins with\u00a0a taxonomy of the different ways investigators might try to bypass\u00a0encryption schemes. We classify six kinds of workarounds: find the key,\u00a0guess the key, compel the key, exploit a flaw in the encryption software,\u00a0access plaintext while the device is in use, and locate another plaintext\u00a0copy. For each approach, we consider the practical, technological, and\u00a0legal hurdles raised by its use.<\/p>\n
The remainder of this Article develops lessons about encryption\u00a0workarounds and the broader public debate about encryption in criminal\u00a0investigations. First, encryption workarounds are inherently probabilistic.\u00a0None work every time, and none can be categorically ruled out every\u00a0time. Second, the different resources required for different workarounds\u00a0will have significant distributional effects on law enforcement. Some\u00a0techniques are inexpensive and can be used often by many law enforcement\u00a0agencies; some are sophisticated or expensive and likely to be used\u00a0rarely and only by a few. Third, the scope of legal authority to compel\u00a0third-party assistance will be a continuing challenge. And fourth, the law\u00a0governing encryption workarounds remains uncertain and underdeveloped.\u00a0Whether encryption will be a game changer or a speed bump\u00a0depends on both technological change and the resolution of important\u00a0legal questions that currently remain unanswered.<\/p>\n