The Government has issued a public consultation[1] stating it intends to bring Part III of the Regulation of Investigatory Powers Act 2000 into force. This gives Government bodies the power to order data to be decrypted and, in certain circumstances, demand a copy of the relevant encryption key.
This article considers why these powers are now being brought into force. It also considers why they may be of concern to many commercial organisations, especially in the financial services sector, and whether they will be effective against more sophisticated cryptographic techniques such as steganography.
1 BitLocker™ Brings Encryption To The Masses
In its most basic terms, encryption is a means to scramble information so that it can only be unscrambled by someone who has the right decryption key. A simple example might be:
The key itself is usually a number. In the simple Caesar cipher example above, the key is (-1) as reducing the alphabetical position of all of the letters above reveals the unencrypted information, a well-known nursery rhyme. Modern encryption methods use much longer numbers with some commentators recommending key lengths of 3072 bits.[2] For this reason they may be stored on a computer, in an external device (such as a flash key) or on the Internet (such as the keys held as part of a public key infrastructure system).
Encryption has a number of legitimate uses and is widely deployed to ensure safe and secure communications. In many cases it is invisible to the end user, for example https (Hyper Text Transport Protocol Secure) is used to encrypt information sent to and from secure Web sites as indicated by the “padlock” sign on Internet Explorer. However, encryption has a darker side and can also be used to conceal evidence of criminal activity. The consultation gives a number of graphic examples of encrypted material being found in circumstances that strongly suggested they contain child pornography. The suspects refused to, or claimed that they were unable to, decrypt the information and the police were therefore unable to review it, prosecute the suspects and identify the victims. There have also been a number of suggestions that terrorists are using encryption to protect their communications and information.
The use of encryption in these circumstances is becoming increasingly common and has started to have a serious effect on the police and security services. Some existing versions of Microsoft Windows already include encryption technology (the Encrypting File System) but the problem will become more marked when Microsoft releases its new operating system, Windows Vista™. The Enterprise and Ultimate versions of Windows Vista™ will include BitLocker™ Drive Encryption to automatically and securely encrypt information held on that computer and will inevitably result in widespread deployment of this technology.
In light of these issues the Government now feels it is appropriate to bring Part III of the Act into force.
2 The Disclosure Requirement
The main power under Part III of the Act is to serve a notice requiring a person who holds a relevant key to use it to decrypt encrypted information. Failure to comply with this requirement is punishable by two years’ imprisonment or, where national security is involved, five years’ imprisonment.
2.1 Restrictions
The obligation to disclose encrypted information is clearly invasive and has the potential to infringe a person’s right to privacy of correspondence under Article 8 of the European Convention on Human Rights. The Act therefore sets out a number of safeguards on the use of this power. First, a disclosure requirement may only be imposed if necessary:
· in the interests of national security;
· for preventing and detecting crime;
· in the interests of the economic well being of the
· to ensure the effective exercise of a statutory power or duty by a public authority.
Secondly, this power must be exercised in a proportionate manner. This involves balancing the actual or potential infringement of the person’s privacy against the benefit in accessing the encrypted information. In particular, a person cannot be required to disclose a key if it is used solely for creating electronic signatures.
Finally, the Act sets out a detailed authorisation procedure which must be used to obtain permission to impose a disclosure requirement.
2.2 Lost Keys
The disclosure obligation applies only if the person in question is in “possession” of the encryption key. Conceptually, this is one of the most difficult issues raised by these provisions as a suspect will inevitably claim that they have “lost” or “forgotten” the encryption key. To counter this problem, the Act presumes that a person continues to hold a key if they held it at any time before the disclosure requirement was imposed. This presumption raises problems of its own.
· It is not clear how to prove someone had access to a key at an earlier time without them either admitting this voluntarily (which seems unlikely) or catching them red-handed using it to decrypt the information in question. In the latter scenario a decrypted copy of the information should already be available and raises the question why the disclosure obligation is necessary in the first place.
· More importantly, it would be extremely difficult for a defendant to provide sufficient evidence that his encryption key has been “lost” or “forgotten”. This is a heavy evidential burden on the defendant and there must be doubts about its compatibility with the requirement under Article 6(2) of the European Convention on Human Rights that a person is innocent until proven guilty.
2.3 Tipping Off
A disclosure notice may also oblige the recipient to keep the existence of the notice secret. This obligation is available only to the police, HMRC or the intelligence services and can be exercised only if reasonably necessary to maintain the effectiveness of an investigation or the well-being of any person.
This obligation causes particular problems for organisations as, in many cases, it will be necessary to speak to other people in that organisation in order to get hold of the encryption key and decrypt the information. While the code of practice states it “is not the intention of the Act to penalise individuals within organisations who, for example, have been given a notice imposing a disclosure requirement but need the assistance of another colleague in order to comply with the notice” there is no formal exemption in the Act and breach of this obligation is punishable by up to five years’ imprisonment.
3 Access to Keys
Part III of the Act can also be used to require the disclosure of the actual encryption key itself. This will generally be an express obligation placed on the recipient though in some cases it will arise as a result of the circumstance in which the disclosure requirement is imposed (for example, where the recipient does not hold the encrypted information and therefore cannot decrypt it themselves).
This is the most controversial aspect of Part III of the Act as it potentially allows access to any other communications made using that encryption key. This power will be of particular concern to financial services institutions and outsourced service providers who rely on encryption to ensure their transactions are confidential and secure. The prospect of the
3.1 Restrictions
In light of these concerns and the heightened risk of a person’s Article 8 rights being infringed, an express obligation to disclose an encryption key can be imposed only if:
· there are “special circumstances” that make the disclosure of the key necessary – the consultation suggests a range of situations in which these circumstances arise, including where the person has failed to decrypt the information properly themselves, the key itself has evidential value or where a decryption obligation is not suitable because split keys are used;
· it is proportionate to require disclosure of the key in light of the extent and nature of the information disclosed and the harm it might cause;
· the key itself is kept securely and destroyed once it has been used to decrypt the relevant information;
· a more onerous authorisation procedure is followed – for example, in the case of the police such an order must be approved by the relevant Chief Constable.
The draft Code of Practice contained in the consultation also recommends that the Chairman of the Financial Services Authority is notified before any financial services institution is required to disclose its keys.
4 Ignoring the Hidden Message
Ultimately, these provisions will be assessed in light of their ability to prevent, detect and prosecute more serious crimes such as child pornography or terrorism. In this respect it is likely they will be found wanting as criminals turn to more sophisticated techniques to protect their communications and information.
4.1 Steganography
Steganography, or the art of hidden writing, is a technique used to hide information so that no one apart from the intended recipient is aware of the existence of that information. A particularly crude and ineffective example might be a poem such as:
Three blinb mice,
See how they ron!
They all ram after a farmer’s wife,
Who cut off their tails with a carving knibe!
On the face of it this is simply a mistyped children’s nursery rhyme. However, a closer inspection (by selecting each mistake in this version) reveals the message “bomb!”.
Real life steganographic systems are vastly more sophisticated and can hide information in a range of data formats such as JPEG images or MPEG movies. The amount of information that can be hidden is proportional to the size of the carrier signal and the amount of noise it contains. Therefore, carriers such as short movies captured by digital cameras could potentially hide substantial amounts of information.
4.2 An Impossible Prosecution?
Steganography appears to pose an insurmountable hurdle to the imposition of a disclosure obligation (or a prosecution for failing to comply with it) as it is predicated on there being encrypted information in the first place.
This requirement cuts against the fundamental purpose of steganography – ie to hide the existence of that information. While techniques, known as steganalysis, can be used to try and detect the use of steganography, in many cases they are limited to a statistical analysis of the carrier signal to see whether it contains more noise than would normally be expected. Given the complex, mathematical and inherently uncertain nature of this analysis, it seems unlikely a jury could be persuaded beyond reasonable doubt that hidden information really is present.
5 Conclusion
The rapid adoption of encryption technology, and most notably the inclusion of BitLocker™ in Windows Vista™, means the Government feels it has little option but to bring Part III of the Act into force if it is to maintain effective measures against crime. However, it remains to be seen whether the safeguards in RIPA and the Code of Practice are sufficient to prevent unwarranted infringement of both personal and commercial privacy. There are also concerns that serious criminals will avoid its provisions altogether through the use of more sophisticated techniques such as steganography.
Richard Cumbley is a Managing Associate in, and Peter Church is a Professional Support Lawyer in, the Technology, Media and Telecommunications Department at Linklaters: www.linklaters.com
Practical Tips
There are a range of steps to consider if Part III of RIPA is brought into force.
• Audit your information technology systems to identify how encryption technology is used and the location of all encryption keys.
• Establish procedures to check that any notice imposing a disclosure requirement is genuine and has been validly served.
• Ensure that encryption keys are accessible in order to respond to a disclosure requirement without compromising the security of those keys. Bear in mind that the notice should be served on a senior member of the organisation and could be subject to a secrecy requirement.
• Use separate keys for encryption and authentication to ensure that electronic signature keys are not subject to a disclosure requirement.
• Ensure that the disposal of any key (eg session keys that are deleted at the end of a session) is properly documented so that you can prove you are no longer in possession of that key
[1] Consultation on the Draft Code of Practice for the Investigation of Protected Electronic Information – Part III of the Regulation of Investigatory Powers Act 2000, June 2006. Available at http://www.homeoffice.gov.uk/documents/cons-2006-ripa-part3/
[2] National
[3] Bank Data Is Sifted by
