Safe Speed Forums

UK police can now force you to reveal decryption keys

Users of encryption technology can no longer refuse to reveal keys to UK authorities after amendments to the powers of the state to intercept communications took effect on Monday (Oct 1).

The Regulation of Investigatory Powers Act (RIPA) has had a clause activated which allows a person to be compelled to reveal a decryption key. Refusal can earn someone a five-year jail term.

Part III of RIPA was in the original Act but was not activated. The Home Office said last year that it had not implemented the provision because encryption had not been as popular as quickly as it had predicted. It launched a consultation which culminated in Part III being made active on 1st October.

The measure has been criticised by civil liberties activists and security experts who say that the move erodes privacy and could lead a person to be forced to incriminate themselves.

It is also controversial because a decryption key is often a long password – something that might be forgotten. An accused person might pretend to have forgotten the password; or he might genuinely have forgotten it but struggle to convince a court to believe him.

Section 49 of Part III of RIPA compels a person, when served with a notice, to either hand over an encryption key or render the requested material intelligible by authorities.

Anyone who refuses to decrypt material could face five years in jail if the investigation relates to terrorism or national security, or up to two years in jail in other cases.

Controversially, someone who receives a Section 49 notice can be prevented from telling anyone apart from their lawyer that they have received such a notice.

The Home Office said that the process will be overseen by the Interception of Communications Commissioner, the Intelligence Services Commissioner and the Chief Surveillance Commissioner.

Complaints about demands for information must be made by the Investigatory Powers Tribunal. "The Tribunal is made up of senior members of the judiciary and the legal profession and is independent of the Government. The Tribunal has full powers to investigate and decide any case within its jurisdiction, which includes the giving of a notice under section 49 or any disclosure or use of a key to protected information," said a Home Office explanation of the process.

The Home Office said that the actions were consistent with the European Convention on Human Rights and the UK Human Rights Act as long as the demand for decryption was "both necessary and proportionate".

"The measures in Part III are intended to ensure that the ability of public authorities to protect the public and the effectiveness of their other statutory powers are not undermined by the use of technologies to protect electronic information," said the Home Office.

An accused person might pretend to have forgotten the password; or he might genuinely have forgotten it but struggle to convince a court to believe him.

... I was informed there that if you said you had forgotten the encryption key then it was up to the police/courts to prove you had not - not the other way around.

Er, I would have thought that proving somebody had not forgotten something was impossible.

Er, I would have thought that proving somebody had not forgotten something was impossible.

Another piece of legislation in the namet ofh huntinge they real_ criminalsc, whicha convenientlyn erodes_ civilf libertiesu, withoutc actuallyk affecting_ theo realf criminalsf.

I attended a lecture about this matter not so long ago, and I was informed there that if you said you had forgotten the encryption key then it was up to the police/courts to prove you had not - not the other way around.
Has this now changed? From the above quote it has but what's the official take on this?

Animal rights activist hit with RIPA key decrypt demand

An animal rights activist has been ordered to hand over her encryption keys to the authorities.

Section Three of the Regulation of Investigatory Powers Act (RIPA) came into force at the start in October 2007, seven years after the original legislation passed through parliament. Intended primarily to deal with terror suspects, it allows police to demand encryption keys or provide a clear text transcript of encrypted text.

Failure to comply can result in up to two years imprisonment for cases not involving national security, or five years for terrorism offences and the like. Orders can be made to turn over data months or even years old.

The contentious measure, introduced after years of consultation, was sold to Parliament as a necessary tool for law enforcement in the fight against organised crime and terrorism.

But an animal rights activist is one of the first people at the receiving end of a notice to give up encryption keys. Her computer was seized by police in May, and she has been given 12 days to hand over a pass-phrase to unlock encrypted data held on the drive - or face the consequences.

The woman, who claims to have not used encryption, relates her experiences in an anonymous posting on Indymedia.

"Now apparently they have found some encrypted files on my computer (which was stolen by police thugs in May this year) which they think they have 'reasonable suspicion' to pry into using the excuse of 'preventing or detecting a crime'," she writes.

"Now I have been 'invited' (how nice, will there be tea and biccies?) to reveal my keys to the police so they can look at these files. If I do not comply and tell them to keep their great big hooters out of my private affairs I could be charged under RIPA."

The woman says that any encrypted data put on the PC must have been put there by somebody else.

"Funny thing is PGP and I never got on together I confess that I am far too dense for such a complex (well to me anyway) programme. Therefore in a so-called democracy I am being threatened with prison simply because I cannot access encrypted files on my computer."

She argues that even if she had used encryption she'd be disinclined to hand over her pass phrase. "The police are my enemy, I know that they have given information about me to Huntingdon Life Sciences (as well as hospitalising me)," she writes. "Would I really want them to see and then pass around private communications with my solicitors which could be used against me at a later date in the civil courts, medical records, embarrassing poetry which was never meant to be read by anyone else, soppy love letters or indeed personal financial transactions?"

Indymedia reports that similar demands have been served against other animal rights activists, a point we have not been able to verify.

The woman was issued a notice by the Crown Prosecution Service, and not (as might be expected) the police. According to the code of conduct, the authorities would normally ask a suspect to put the files into intelligible form, though how this would work when a PC is being held by the police is far from clear.

It's unclear if the woman was given an official Section 49 notice or simply "invited" to hand over the data voluntarily as part of a bluff by the authorities.

Richard Clayton, a security researcher at Cambridge University and long-time contributor to UK security policy working groups, said that only the police are authorised to issue Section 49 notices. "What seems to have happened is that the CPS (who couldn't issue a notice anyway) have written asking the person to volunteer their key," he adds.

"Should they refuse this polite request, they are being threatened with the subsequent issuing of a notice, which might or might not require the key to be produced (it might of course just require the putting into an intelligible form of the data)."

Clayton expressed concern that the incident illustrates possible holes in the long-delayed code of practice. "It would clearly be desirable to seek NTAC's views before approaching suspects with requests for keys (rather than requests to put into an intelligible form) - lest the authorities give the impression that they know rather less about the rules (and the operation of encryption systems) than everyone else," he said. ®