New encryption law might cause more problems than it solves

Publicity could cause more people to encrypt their documents

Anthony Dhanendran, Computeract!ve 28 Jun 2006

The government's plans for dealing with encrypted documents could backfire, according to one security expert.

Later this year, a controversial law, the Regulation of Investigatory Powers Act (RIPA), will be amended so that government agencies can demand access to documents that have been encrypted.

The proposed ammendment to the law will mean people who encrypt their files can be required to hand over the key to the authorities if the police suspect that they are connected to a crime.

Ripa was enacted in 2000, but the original provision on encryption was left out because the government's opponents argued that it could infringe on civil liberties.

However as PCs and files stored on hard drives become increasingly vulnerable to attack from cyber criminals and hackers, people have started to use encryption technology to keep their data safe.

Now the Home Office has argued this increasing use of encryption by the public has made it necessary to give public authorities, such as the police, HM Customs and Excise, the power to demand the keys to encrypted files.

Failure to do so could be punishable by up to five years in jail.

However, one security researcher says that the plans could leave the authorities having to deal with more encrypted documents being produced, not less.

Dr Richard Clayton, of Cambridge University, says that the coverage that will be given to encryption if the law is changed will make more people, including criminals, encrypt their documents.

He said: "I think it will make it more likely that police will encounter encrypted material because people will become aware of how easy it is to use."

However a spokesperson for the Home Office said that increased use of encryption would not be a problem, adding that the Act will compel people to reveal their keys if their documents were under investigation.

However, Struan Robertson of law firm Pinsent Masons accused the government of "a certain amount of scaremongering".

He told Computeractive that the law is unlikely to be used in many cases

"The way the law is written it can apply to any crime, however minor. But it's not in the interests of the police to get involved with encrypted data in most cases," he said.

The Home Office is currently running a public consultation on how the new law should work.

See also: