DTI Policy Response

[Nicholas Bohm]

At 07:21 28/04/1998 -0500, Ken Brown wrote:

[snip]

>More to the point, I don't see that section 14 of the Statement implies a
>compulsory infrastructure-based key-recovery GAK. In fact it rules it out
>for private users and unlicensed providers. To my non-lawyerly mind it says:
>"if you have an encrypted message that we think is evidence, and  you don't
>tell us what it says when we ask you, then we will put you in prison". Which
>may be bad news but surely is no different from the current law about
>witholding evidence?  This seems to be, just about, in line with the
>pre-election Labour Party document.   There is no stated  requirement for
>anyone other than a licensed encryption provide (& I strongly suspect they
>will be like hen's teeth)  to go out of their way to make prior arrangements
>to let the spooks in.

Existing law on interception and intrusion means that if a warrant is
issued, you have no remedy if your phone is tapped or your door broken
down.  A warrant does not compel you to do anything, it deprives you of
remedies you might otherwise have for things done to you.

New law would say that if you have received an encrypted message and a
warrant demanding the key, you must provide the key (in the face of some
sanction for refusal, presumably).  The requirement for positive
co-operation would be new.  It is not easy to see what will happen if you
claim (truthfully or plausibly or both) to have forgotten the password or
destroyed the key.  It is not clear whether providing the plaintext without
the key will be sufficient.  It is not clear whether providing the session
key instead of your private key will be sufficient.  It is objectionable to
have to provide your private key and thus give access to all other messages
sent to you as well as the one the subject of the warrant.

It is also not clear whether a licensed provider of a certificate for a PGP
key is "facilitating encryption services" (Statement, para 12), and so
subject to mandatory recovery obligations.  The reasoning would be that a
PGP key cannot be said to be used solely for signature (whatever the
intentions of its owner, since third parties can use it to encrypt messages
sent to the owner).

If this is really how it is meant to work, no PGP key user could get a
licensed CA certificate for the key without submitting to escrow (which
would undermine the reliability of signatures using the key).

It seems remarkable that these uncertainties, which are indistinguishable
from the uncertainties which provoked so much debate on the last
Government's proposals, have persisted unscathed into the present
Statement.  Superficially, and in some welcome ways, much has changed: but
fundamentally the same problems lie beneath the amended ambiguities.

	Regards,

		Nicholas Bohm

Salkyns, Great Canfield,
Takeley, Bishop's Stortford CM22 6SX, UK

Phone		01279 870285	(+44 1279 870285)
Fax		01279 870215	(+44 1279 870215)
Mobile   	0860 636749  	(+44 860 636749)

PGP RSA 1024 bit public key ID: 0x08340015.  Fingerprint:
9E 15 FB 2A 54 96 24 37  98 A2 E0 D1 34 13 48 07
PGP DSS/DH 1024/3072 public key ID: 0x899DD7FF.  Fingerprint:
5248 1320 B42E 84FC 1E8B  A9E6 0912 AE66 899D D7FF