(IANAL.) From the three last options proposed in the article: - Option 1 doesn't make sense to me because, if you assume that private crypto is lawful, the pho

(IANAL.) From the three last options proposed in the article: - Option 1 doesn't make sense to me because, if you assume that private crypto is lawful, the phone's data could be encrypted using the passcode, so that it would be technically impossible to bypass the passcode. - Option 2 seems like a bad idea to me. The central premise is that there is one passcode which you must know, so you can be forced to provide it. However, if you are using deniable encryption you could have multiple passcodes, an "everyday" passcode, a "secondary" passcode for sensitive data, a "duress" passcode, etc., and there would be no way for you to prove that you have provided everything. Under this interpretation, forcing users to hand in "all available passcodes" sounds too much like asking the accused to help the investigation make sense of their encrypted data. - Option 3 seems more reasonable (although I think it is undesirable). In fact, I am surprised that retention of text messages is not yet an obligation under the law (though maybe they are already retained, just not lawfully). Of course this would make a lot less sense if people (or their phones) encrypted texts... Yes, telephony is stuck with historical ad-hoc messaging protocols (SMS), proprietary devices, OSes and applications, with strong dependencies to their manufacturers and mobile providers, and people do not often use serious crypto on them. But mobile phones with a mobile connection are essentially computers on a network, and one should be wary of special bypass mechanisms on passcodes or texts that would make no sense with computers.