Ripa encryption keys powers for police

A move that would see businesses and individuals compelled to reveal encryption keys that have been used to protect data has been widely criticised by civil rights organisations.

The powers themselves are contained in Part 3 of the Regulation of Investigatory Powers Act, (Ripa); the original legislation was enacted in 2000, but the Government has held back on implementing this section of the Act. Under the Act anyone refusing to disclose their keys would face up to two years’ in prison, while under current anti-terrorism legislation terrorist suspects could face five years.

The Home Office has recently launched a consultation process as it believes the new powers would help law enforcement organisations fight terrorists, criminals and paedophiles.

Home Office Minister Liam Byrne told Parliament recently: “The use of encryption is… proliferating. Encryption products are more widely available and are integrated as security features in standard operating systems, so the government has concluded that it is now right to implement the provisions of Part 3 of Ripa… which is not presently in force.”

However, Cambridge University security expert, Richard Clayton, told ZDNet UK: “The controversy here [lies in] seizing keys, not in forcing people to decrypt. The power to seize encryption keys is spooking big business.

“The notion that international bankers would be wary of bringing master keys into the UK if they could be seized as part of legitimate police operations, or by a corrupt chief constable, has quite a lot of traction. With the appropriate paperwork, keys can be seized. If you’re an international banker you’ll plonk your headquarters in Zurich.”

A Home Office spokeswoman said: “We are in consultation and are looking into proposals on amendments to Ripa. The Home Office is waiting for the results of the consultation [before making any decisions].”