This method won't work for most 'after the event' scenarios, such as the San Bernadino case, because the subjects are often deceased, and so unlikely to be updating the software on their phones or computers, so it can only possibly apply "upon suspicion". ie. pre-crime...
This opens up questions as to how someone becomes 'suspicious' if their communication is already encrypted. And if they're already a person of interest, how many myriad other ways do they have of surveilling them or checking out their activities? Terrorist attacks require non-electronic items that have to be purchased, stored, and constructed in non-electronic places. There are existing ways to surveil people, under warrant. GPS trackers, phone records, bank statements, listening devices, watching devices, IMSI catchers, metadata (which Australia has legislated must be kept by ISP's for a couple of years).
This new legislation feels like a LOT of effort for a very small percentage return over and above those things I've already listed, especially considering:
- How long would it take to develop and deploy a targetted version of a program?
- What's the likelihood of the target updating their program during the useful window of time?
- Is this timeframe going to be of use to law enforcement?
- If the timeframe is justified, what's the time limit? Is 'suspect' going to have their comms intercepted for the foreseeable future? At what point is the well deemed to be dry?
- At what point does warranted surveillance become government harassment?
What this looks like from the outside is more psychology than technology:
- Hey Terrorists, we can do these things so, you know, re-think your life's direction
- Chilling effects: encourage paranoia, discourage dissent, even discourage disagreement