New law forces PC owners to hand over encryption keys

 

Gallery

By Matthew Sparkes

Posted on 1 Oct 2007 at 17:29

British law enforcement agencies have gained the power to demand the decryption of any data relating to their investigations.

Refusing to do so could now incur a five-year jail sentence if the investigation is a matter of national security, and two years otherwise.

The powers are part of the third section of the controversial Regulation of Investigatory Powers Act (RIPA), which was passed in 2000, but not activated until this week. The act was specifically designed to stop investigations being hampered by advanced communications tools.

Under section 49 of the act, any judicial authority, chief of police, customs and excise commissioner or military officer ranking higher than a brigadier can order an encryption key to be handed over to authorities. It is also possible to issue an order that the recipient cannot tell anyone that they have been served a "Section 49".

With encryption becoming more common, both in everyday use and by criminals, investigations are often delayed.

However, computer experts have cast doubt over the effectiveness of the new legislation. "There are some defences in the statute to failing to comply with a notice - one of which is that you can claim to have forgotten the decryption key (in practice, the passphrase under which the key is stored)," writes Professor Ross Anderson, from Cmabridge University, on his blog. "In such a case the prosecution must show beyond a reasonable doubt that you have not forgotten it. Since they can't mind-read, the expectation must be that they would attempt to show regular usage of the passphrase, and invite the jury to conclude that the forgetting has been faked - and this might be hard to manage if a hard disk has been in a police evidence store for over a decade."

"However, if you're still using such a passphrase and still have access to the disk, and if the contents are going to incriminate you, then perhaps a sledgehammer might be a suitable investment," Anderson concludes.