A couple of somewhat contradictory points: (1) Procedures are only as good as the people who follow them. Somebody has to actually access the data - that guy

A couple of somewhat contradictory points: (1) Procedures are only as good as the people who follow them. Somebody has to actually access the data - that guy is the insider you have to worry about bypassing the procedures. Maybe I am just not imaginative enough, but I can't think of a scenario that is completely immune to the single insider. The best I can come up with would be key-splitting such that everybody with a piece of the key would need to agree that it is a valid access request. But even then you have to worry about the process for generating the key before it is split. Even if everybody is in the room when it is generated and split, you have to worry about whether the computer doing the generation wasn't compromised by the insider to surreptitiously make a copy of the whole key. (2) The idea of creating a system for data access presupposes that any developer must cater to the potential desires of law enforcement and make the effort ($$$) to accommodate them before they've even issued a valid court order. CALEA has put that burden on some telecom operators, but on the other hand the Clipper Chip with its key escrow system was an attempt to manipulate the market into building such access into all encrypted comms and Congress didn't even come close to passing that for government use and so the free market didn't even try. CALEA: https://en.wikipedia.org/wiki/Calea https://en.wikipedia.org/wiki/Calea Clipper: https://en.wikipedia.org/wiki/Clipper_chip https://en.wikipedia.org/wiki/Clipper_chip EDITED TO ADD: (3) There is also the trade-off between security and cost. We all know there is no such thing as perfect security, only an increasing level of cost to circumvent or penetrate. As you mention, a procedural system gets more expensive to compromise the larger the number of people necessary to grant access. But at what point does the cost to bribe or otherwise co-opt all those people equal or exceed the cost to crack the encryption? Just a SWAG, but lets say a well-implemented encryption system takes $100M to crack, how many people can you compromise for the same amount of money? What if $25M is enough to buy the entire company outright? A system that is more expensive to crack because the only means of access is through good crypto is a more valuable service than one with an access procedure involving humans. Maybe that theoretical drug cartel can afford $25M but they can't afford $100M. So a user of a pure-crypto system would be safe from the cartel but one with a process for law-enforcement access would not.