the frightening RIP bill (19/02/2000)
Regular readers of this irregular column will know that I have a bee in my bonnet about the way that personal privacy is affected by technology. Now there's another potential nail in the coffin of your right to a private life. Jack Straw, making Michael Howard look like a socialist hippy, is attempting to push through the Regulation of Investigative Powers Bill, which has serious implications for justice as we know it.
What it boils down to is that the police and other investigative agencies will, if the Bill is passed, have the power to demand access to any encryption keys held by you and relating to data that you have stored, sent or received. The killer clause is that if you don't hand over the key, even if you don't have it, you could be sent to jail. You would have to somehow prove your innocence, rather than the police having to prove your guilt. In this way, the burden of proof would be reversed. To put it mildly, this takes the piss.
It's not just UK civil liberties groups that have criticised this Bill. Major corporations have, too, and it would be interesting to see how it would stand up in the European Court. The bill gets its second reading on March the 6th, so if you value what's left of your basic privacy rights, do something about it now.
More information is available at the Foundation for Information Policy Research and STAND.org.uk. The latter organisation sent the following e-mail to Jack Straw last year, highlighting the problems with the proposed law - as part of the E-commerce Bill - very effectively.
Dear Mr Straw,
How the E-commerce Bill could send YOU to jail
Please find at the end of the letter a confession to a crime, which has been affirmed by Statutory Declaration. The Commissioner of the Metropolitan Police has been informed that you are in possession of this information.
You will not be able to understand the confession, because the words have been scrambled using a strong cryptographic key. This key was created in your name and has been registered on international public key servers.
The police may come and demand that you supply the key required to make this message intelligible. If you fail to do so you would be committing an offence under the E-Commerce Bill rendering you liable to imprisonment for up to 2 years.
The fact that you don't possess this key won't help you unless you can prove that you don't have it. I wish you well in proving that it isn't hidden away on a disk in your secretary's home, or squirreled away on the Internet somewhere. We might have sent it to you last week; but according to the Bill, the police won't have to prove you ever had it at all.
Even if you can prove that you don't have it you would STILL be liable for imprisonment unless you give information to the police that enables them to decrypt the key. Unfortunately for you this is impossible, because we've destroyed all copies of the key in our possession.
If the police ask you keep the demand to hand over the key secret, telling anyone would render you liable to 5 years in jail. So you couldn't complain - or explain your predicament - to the PM or Home Secretary, to the Chief Whip or a journalist, or even to another policeman.
Happily for all of us, the E-Commerce Bill has not yet been enacted by Parliament, so we have not in fact set you up for jail time. The Bill will be introduced in the coming session.
I hope this exercise has demonstrated some of the drafting flaws in the Bill as it stands - copies of which are available from the DTI. I hope we have also demonstrated that it is not the perpetrators of crime who would suffer under these draconian new powers, but innocent parties who are in receipt of communications from miscreants. This is why such sober organisations as BT, Hewlett Packard and Microsoft have publicly criticised the Bill at each stage of its development.
I trust that when the Bill reaches the House we can rely on your most careful scrutiny. Further analysis is available on our web site at: http://www.stand.org.uk/
I am, Sir, Your most obedient servant,
Malcolm Hutty
This Bill will not, of course, have any effect whatsoever on real criminals. They'll simply use concealment rather than encryption, or both. If you're thinking of doing the same thing, by the way, you might want to give Steganos a try. But don't tell Jack Straw I sent you.
The image below does not contain a strongly-encrypted photograph of a politician taking a bribe, paying a prostitute and snorting cocaine.
