Decryption Mandates and Global Internet Freedom: Toward a Pragmatic Approach

PDF version

What effect would a U.S. decryption mandate have for international human rights? Would Burr-Feinstein or something like it hurt dissidents and journalists living under authoritarian governments? It depends who you ask—but the answer you get will probably tell you more about that person’s view of the domestic decryption debate than about how other nations are likely to respond to U.S. encryption policy.

In the attached essay, I argue for a more pragmatic, realistic, and factually informed debate over the international consequences of U.S. encryption policy. Below are a few key points on the matter.

First, it’s perfectly rational to believe that some overriding principle resolves this debate one way or another—for example, that the United States’ obligation to stand with dissidents is so sacred that any harm to dissidents outweighs even great harm to domestic law enforcement. But most Americans—and that includes most members of Congress—are not ideologically precommitted to support or oppose a decryption mandate. For these pragmatic observers, whether the United States should forswear a tool that (for purposes of argument) might be desirable as a matter of domestic policy will depend on whether or not what the United States does domestically will in fact have significant consequences overseas.

Second, it is an open question whether, and to what extent, a U.S. decryption law would reverberate internationally. It may be that the United States’ example exerts little influence internationally, or that other countries’ determination to control the technology available to their citizens is sufficiently strong to overcome any US influence. Alternatively, even if a domestic decryption mandate would exert some drag on U.S. credibility internationally, it might still be possible to deny some weak authoritarian states access to equivalent tools. If the causal link between U.S. domestic policy and international developments is weak, then international effects should carry relatively little weight in deciding whether a decryption mandate is a good idea. If the causality is strong, those international consequences should carry relatively more weight.

Third, this analysis this calls for predictive judgments—which can’t be made with absolute certainty—rather than hard, empirically validated facts. That doesn’t mean, however, that the debate about the international human-rights consequences of U.S. decryption policy is doomed to take place in a factual vacuum. These are the same type of predictive judgments about other states’ anticipated behavior that analysts routinely form and on which policymakers routinely rely in making foreign policy. Reasonable default assumptions are that national interest, capability, relative power, and other mostly objective and knowable factors will shape what other nations seek to do, and what they are able to do. Well-informed forecasts of this type are as sound a basis for policymaking in the encryption debate as they are in political, military, and economic affairs more broadly.

Fourth, it is important to distinguish among those foreign states that U.S. policy aims to influence. Authoritarian great powers have the technical sophistication and economic clout to ensure that foreign technology is, as the Chinese government puts it, “controllable” by the state—regardless of what the United States does. On the other hand, weak, technologically unsophisticated authoritarian states with little market power may be less able to control which products are available to users in their countries. Arguments about the international human-rights consequences of U.S. encryption policy should account for the fact that not all authoritarian governments are equally capable of resisting U.S. policy. That China and Russia will go their own way regardless of what the United States does, even if true, is not an argument-ender; the ability to constrain less-powerful illiberal states may in itself be a significant consideration.

Finally, I offer some unsolicited advice to the parties to the debate. Because most Americans are not ideologically precommitted to one outcome or another, arguments phrased in terms of rigid principles are less likely to persuade than arguments focused on the specific costs that a decryption mandate would impose or the specific benefits it would confer. That means that instead of exchanging pre-baked, ideologically rooted conclusions, the parties would be well-advised to focus on building out a factual record to support their claims.

That means explaining, in specific and concrete terms, how and to what extent a U.S. decryption mandate would, or would not, matter overseas. For example, opponents will want to show that analogous technologies developed for legitimate law-enforcement use have tended to “leak out” to autocracies. Conversely, proponents will want to muster evidence that other countries will proceed with their own decryption laws regardless of what the United States does—or, more subtly, that powerful autocracies will proceed while weaker ones can be pressured or coerced to forgo mandatory decryption even if the United States goes ahead with such a policy.