Will the UK Government RIP off encryption keys?

Monday saw the passing into law of Part three of the Regulation of Investigatory Powers Act 2000, specifying the requirements for disclosure of encryption keys to law enforcement. More than half a decade after it was first conceived, this highly controversial legislation empowers official investigators and the judiciary to demand encryption keys from suspects and their agents to enable them to decrypt information seized in the course of criminal investigations.

The distinction between a legal obligation to decrypt data and a legal obligation to hand over the encryption keys has worried many observers throughout the whole period this legislation has been in the pipeline. It has been suggested that the interests of third parties might be jeopardised: for example, a bank might be exposed if one of its customers were ordered to hand over their encryption key. Others have raised objections from a civil liberties perspective, some even postulating that encryption is dead as no key will be sacrosanct.

But before such a "Section 49" notice can be issued, there must be a clear case for access to the encrypted information on grounds of national security, crime prevention or national economic necessity. The notice must be approved at Commissioner level or by the judiciary, and can only be issued if the information cannot be accessed without the key being provided.

Furthermore, despite the penalties for non-compliance (two to five years incarceration) there is a defence where it can be asserted that the key is lost. In that case the onus is on the prosecution to show beyond reasonable doubt that the key still remains in the possession of the defendant. Finally, due to jurisdictional limits, only encrypted data and keys physically held within the UK seem to be subject to the new provisions.

Still, there might be a way around the RIPA obligations by the means of "plausible deniability", which is an advertised feature of a number of disk encryption products. Since these tools can hide encrypted data, which looks like random data unless you have the key, within other pseudo random data, suspects might only have to reveal the key to the outer crypto container to comply with the law.

(mba)