But do we in the IT world really want to be providing an untraceable means of communication for the next 9/11 bombers? Or, for that matter, white collar criminals, bank robbers, etc.?Yes, we do.
Sometimes it is an inevitable consequence of the march of technological progress that certain legal and civil artifacts of previous eras must fall away, and we need to let that run its natural course, instead of trying to put up pointless and ineffectual -- but costly and frightening -- bureaucratic boondoggles in its way.
As various articles on the subject have pointed out, it's fundamentally antithetical to the decentralised core architecture of the Internet and the whole technology stack on which it is founded to have tap points like this, as if it had the hierarchical and highly centralised, despotic technical, political and economic properties of the public switched telephone network (PSTN).
There's no getting around the changes that it brings: unprecedentedly powerful encryption in the hands of ordinary consumers, complicated encapsulation and tunneling schemes, a great deal of indirection and ad-hoc, peer-to-peer negotiation. We will just have to live with the fact that secure end-to-end electronic communication that is not accessible by law enforcement are available to anyone who really wants it. For the most part, this is good news for privacy, civil rights and protection from information crime; in a few extremely marginal cases, like terrorist plotters and whatnot, this is bad, but we can't have our cake and eat it too. Trying to stop it in the manner proposed is a pointless waste of time.
But as we all know, these ideas can still exact crippling costs in money, time and energy when government imposes bureaucratic requirements, especially when they are so anachronistic (as they are, in this case) as to be instantly relegated to the realm of the symbolic. Nobody can realistically comply with the aims of this initiative, but depending on how far it goes, everyone will have to go through the motions of compliance, as we do with so many other narrowly conceived regulations thought up by idiot politicians that are wildly out of phase with actually-existing technical reality. It reminds me of the phrase "we pretend to work, and they pretend to pay us" from my native USSR.
As we repeatedly see, small companies have the most to lose, because they don't have nearly as much resources to sustain certain manifold illusions or charades that private business has to sustain in relation to the on-paper regulatory demands of innumerable government agencies and oversight bodies. When government dreams up something like CALEA, it's a lot like SOX; the amount of paper-pushing, slippery abstraction and byzantine process engineering in the resulting specification is something that, provided compliance to the letter is even logically possible, only big companies that operate processes on an enormous scale (and with enormous liquidity!) can stand implement. Everybody else, virtually by definition, is just too poor to play in the Big Boys' pond. It's still a meaningless boondoggle that doesn't actually accomplish anything concretely useful, but, for example, ILECs like AT&T, Verizon, Qwest, etc. can at least appear to comply.
It also paves the way to selective enforcement for purposes of extortion or official harassment, and the various other well-known consequences of making implausible laws.