Cyber-Rights & Cyber-Liberties (UK) (http://www.cyber-righs.org) is a non profit civil liberties organisation which was founded with the aim of promoting free speech and privacy in regard to the Internet. CRCL(UK) has been following the government’s encryption policy making process since the DTI’s initial White paper was published in June 1996, and CRCL(UK) has been instrumental in establishing a pro-privacy movement within the civil libertarians within the UK. Ever since June 1996, CRCL(UK) has produced reports and statements in relation to this policy making process, namely:
This response will concentrate specifically on the second part of the DTI Consultation paper, Building Confidence in Electronic Commerce, namely on law enforcement issues and the criminal usage of the encryption technology. We are unable in the unacceptably short time made available to provide any considered responses to the government proposals on "digital signatures"
A Principled Approach
Cyber-Rights & Cyber-Liberties (UK) believe the use of encryption should be prima facie respected and even encouraged for the UK citizens. Therefore, the government approach should be criticised as being fixated on the value of encryption solely in connection with commerce and ignoring wider political and social uses of information technology which might legitimately require the use of encryption. So far, the Government through the DTI has ignored these wider issues involving legitimate use of the encryption technology for private correspondence between UK citizens.
Although the Government "believes that it is important to monitor [the international developments] carefully to ensure consistency with [its] own policies" (paragraph 6 of the consultation paper), the DTI managed to ignore the importance given the fundamental human rights such as freedom of expression and right to privacy by such international bodies as the European Union, and the OECD (Organisation for Economic Cooperation and Development).
The DTI consultation paper in paragraph 7 refers to the European Commission’s October 1997 Communication, and states in paragraph 11 that "the Government sees its proposals for powers to allow lawful access to encryption keys as being in line with the October 1997 European Commission Communication." The DTI paper further states that "this recognised the competence of Member States with regard to the areas of national security and law enforcement. It further recognised that the abuse of encryption will cause problems for law enforcement." The DTI paper also quotes the European Commission:
"Privacy considerations suggest not to limit the use of cryptography as a means to ensure data security and confidentiality. The fundamental right of privacy has to be ensured, but may be restricted for other legitimate reasons such as safeguarding national security or combating crime, if these restrictions are appropriate, effective, necessary and proportionate in order to achieve these other objectives." European Commission Communication "Ensuring Security and Trust in Electronic Communication."
However, the same European Commission paper the DTI cites acknowledges the importance of a right to private communications by reference to international agreements. Therefore, the European Commission’s Communication on Encryption and Electronic Signatures pointed out that:
"International treaties, constitutions and laws guarantee the fundamental right to privacy including secrecy of communications (Art. 12 Universal Declaration of Human Rights, Art. 17 International Covenant on Civil and Political Rights, Art. 8 European Convention on Human Rights, Art. F(2) Treaty on EU, EU Data Protection Directive)…….. Therefore, the debate about the prohibition or limitation of the use of encryption directly affects the right to privacy, its effective exercise and the harmonisation of data protection laws in the Internal Market."
Furthermore, the same European Commission communication paper on encryption stated that "most of the (few) criminal cases involving encryption that are quoted as examples for the need of regulation concern ‘professional’ use of encryption. It seems unlikely that in such cases the use of encryption could be effectively controlled by regulation."
The DTI Consultation paper does not therefore fully address this issue which has been fully considered by the European Commission. Furthermore, principle 5 of the OECD Guidelines on Cryptography Policy stated that "the fundamental rights of individuals to privacy, including secrecy of communications and protection of personal data, should be respected in national cryptography policies and in the implementation and use of cryptographic methods." The DTI consultation paper in paragraph 13 claims that "this policy is entirely consistent with the OECD Guidelines on Cryptography Policy." However, this remains debatable with too much emphasis being given on e-commerce and law enforcement issues while completely ignoring the other beneficial usage of the encryption technology by individuals. Therefore we do not agree that "the Government proposals achieve this balance" as stated in paragraph 13.
More importantly, a survey of recent Internet-related papers issued by the DTI (including this last consultation paper) would strongly suggest that privacy is not one of its prime concerns. So far, privacy issues in relation to the use of strong encryption systems have never been fully addressed by the DTI. This silence is especially remarkable in the light of other governmental initiatives. A right to privacy will soon be part of our lives within the United Kingdom under the Human Rights Act 1998 and a "right to respect for private life" will become part of the British law for the first time by reference to article 8 of the European Convention on Human Rights and Fundamental Freedoms (1950):
"(1) Everyone has the right to respect for his private and family life, his home and his correspondence
(2) There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder of crime, for the protection of health or morals, or for the protection of the rights and freedoms of others."
It will be noted that Article 8 expressly incorporates a right to privacy in "correspondence", and this has long been interpreted by the European Court of Human Rights as including privacy in relation to communications via telecommunications networks. Indeed, the United Kingdom has already been found to be in breach of article 8 on several occasions for failing to pay adequate attention to the value of privacy. We feel that there is a substantial risk that Internet-related proposals emanating from the DTI and the Home Office are in danger of repeating this error.
While the government considers that its proposals meet the requirements for lawful access as advocated by the European Union (paragraph 12 of the DTI consultation paper), Cyber-Rights & Cyber-Liberties (UK) did not so far see any convincing evidence of the fact that criminal usage of the encryption technology is already a "threat to national security" or that it will create such a substantial threat to justify such an invasion of privacy by pursuing key recovery or key escrow systems.
Our reading of the DTI consultation paper suggest that the idea of having a regulatory system with "key escrow or key recovery" techniques is not completely outside the scope of the DTI and the Home Office and reliance upon the concept of trusted third parties is still a possibility under the current proposals.
Paragraph 14 states that the "UK is fully supportive of the OECD declarations of the Ottawa Ministerial Conference and will ensure [that] our own proposed legislation reflects both their spirit and content."
Cyber-Rights & Cyber-Liberties (UK) notes that the OECD declaration on the "Protection of Privacy on Global Networks," refer to privacy-enhancing technologies such as encryption and encourages the use of such technologies for the protection of online privacy. Therefore, the OECD declaration states that:
"Privacy-enhancing technologies can also be used in conjunction with either self-regulatory or legislative approaches. These technologies can enable users to protect their privacy and personal data, for instance by providing mechanisms for user anonymity, encryption, or automated application of user privacy preferences…. Privacy-enhancing technologies should not be seen primarily as novel technical developments or as additions to existing systems. Rather, they should be seen as part of a design philosophy: one that encourages (in appropriate circumstances) the removal of identifiers linked to personal data, thereby anonymising the data. The applicability of this approach will vary. It may not be appropriate or practical to anonymise data, or pseudonymity might be preferable. The approach emphasises the need to incorporate privacy protections into a system at an early stage, not as an afterthought."
Furthermore, the OECD declaration states that:
"education and awareness about privacy issues, protection and enforcement mechanisms are fundamental. This is particularly true in the online world where the collection and handling of personal data is simple and inexpensive, and where user-empowering technologies can give control of and responsibility for personal privacy to individual users. Users need to be educated about the risks they face, their rights, the technological and legal means available to protect their privacy, the meaning and effect of privacy statements and the means of redress available for breaches of privacy principles. Education is also important to businesses who need to be aware, not only of any legal obligations to which they may be subject, but also of the importance of privacy to their customers, the technologies they should use, and practices they should follow in order to comply with the applicable privacy principles."
Cyber-Rights & Cyber-Liberties (UK) has seen no evidence that the Government is committed to these principles and the protection of individual online privacy and we regret that the government has not given any thought or consideration for these equally important issues while formulating its policy. We would therefore like to see the Government committed to the above OECD principles.
In relation to export controls, paragraph 47 of the DTI consultation paper states that "the proposed legislation will not, in itself, affect the current export controls on cryptography products, which are shaped by our international agreements. However, it is likely that it will be possible to streamline the procedures for the export of cryptographic products which facilitate legal access through a third party (such as products incorporating key storage or key recovery). One way of doing this might be to permit the export of such products which met set criteria under an open licence after a one time review."
Legitimate Law Enforcement Interests in Cryptography
The size of the problem
Paragraph 48 of the DTI consultation paper states that "criminals are quick to take advantage of new technologies and there is no doubt that serious criminals (e.g. drugs traffickers, terrorists and paedophiles) will exploit encryption in an effort to defeat the work of law enforcement agencies. Indeed, this is already starting to happen. The Government therefore has the dual responsibilities of promoting and facilitating the lawful use of encryption by business and others, and making it as difficult as possible for criminals to exploit it for their own purposes."
Having seen to date no evidence that these "serious criminals" already do, or will, exploit encryption, Cyber-Rights & Cyber-Liberties (UK) would like to see evidence of such a scenario taking place now or evidence in relation to such a scenario taking place in the future. In the absence of publicly available data and research, the above statement remains unsupported and does not help in engaging the members of the public in a healthy and constructive debate. Important freedoms should not be sacrificed on the basis of scare stories.
According to paragraph 49, "a number of recent investigations into a variety of serious criminal offences in the UK have been hampered by the discovery that material which might otherwise assist the investigation, or be used in evidence, has been encrypted."
Although the Consultation paper states that "the problem is increasing," the cited examples within the consultation paper suggest otherwise. We believe there is no convincing evidence that the use of encryption has created significant new problems for law enforcement. We will now challenge the cited examples within paragraph 50 of the DTI consultation paper.
The first example cited by the DTI paper is the same example given by a January 1999 NCIS press release, and according to the National Criminal Intelligence Service ("NCIS"), in early 1998, police enquiries into an attempted murder and sexual assault were impeded by the discovery of encrypted material on a suspect’s computer. The investigator was able to proceed only after the private encryption key was discovered by the police amongst other material seized from the suspect. But the private encryption key was in fact recovered rather than not.
In relation to child pornography and the usage of the encryption technology by paedophiles, the examples given are again unconvincing. The DTI paper cites cases in which the suspects "were subsequently convicted of distributing child pornography, [however] the police investigation into the leading suspect was severely hampered by the fact that he had used encryption."
In fact the DTI consultation paper is referring to a particular case involving the "Operation Starburst" which caused the arrest of 37 persons in the UK, USA, Germany, South Africa, Hong Kong and Singapore. But the detection was nevertheless effected through a mixture of physical surveillance of suspects, telephone and financial checks to establish their usage of their ISPs, and then the physical seizure of their computers. Though some of the material was encrypted (with PGP) in a particular case (Smith), there was plenty of unencrypted material available on which to base a prosecution and conviction. It should be noted that there was no trace of encryption in the other criminal prosecutions following the Operation Starburst.
Another child pornography case is the case of Father Adrian McLeish, a Roman Catholic priest, who was sentenced to six years’ imprisonment in November 1996 for child abuse and child pornography offences. This case is not cited either by NCIS or by the DTI but it is important to mention it as it included criminal usage of encryption. During Operation Modem by the Durham Police, it was discovered that McLeish used encryption software. But McLeish’s use of encryption was not a problem for investigators, as McLeish handed over his encryption keys together with his private passphrase - "Overhead the moon is beaming". McLeish admitted 12 specimen charges of indecent assaults against two boys, one aged 12 and another aged 18. He also admitted distributing indecent photographs, possessing them with intent to distribute them and being involved in the importation of pornographic videos of children.
The example given in relation to terrorist usage of encryption again originate from the January 1999 NCIS press release. In late 1996, a police operation culminated in the arrests of several leading members of a terrorist group and the seizure of computer equipment containing encrypted files. The files held information on potential terrorist targets such as police officers and politicians. The data was eventually retrieved, but only after considerable effort. But, again, we note that the data was retrieved.
The Serious Fraud Office currently estimates that in approximately 50% of its cases, some form of encryption is encountered. Instances of computer files protected by various complexities of encryption have been found in a number of recent investigations. The problem is growing, and attempts to overcome the encryption are absorbing resources which could otherwise be deployed elsewhere. But there is no evidence presented that prosecutions cannot be mounted based on other evidence.
Commercial interests face a range of potential threats from improper use of encryption. Individuals involved in corporate espionage and insider theft will naturally be drawn to encryption devices as a means of concealing their activities. There have been attempts to extort money from businesses by placing enciphered viruses into computer systems (so-called cryptoviral extortion). Law enforcement agencies would be better able to investigate such criminal activity if they had a power to obtain relevant encryption keys. But the prime responsibility for security against internal attack in this way must lie with the commercial body - the commercial sector should not be allowed to expect the public purse to pay for its lax ways of working or to ask for the freedom of all to be curtailed because of the laziness of some.
The international examples cited within the DTI paper originate from a US paper by Denning and Baugh which state that encryption is used by organised crime and for espionage. This paper cites seven cases of terrorism (two of them included within the DTI Consultation paper) which involved encrypted files within computers, but in all of these cases the law enforcement agents managed to decrypt the files during their investigation. Examples cited by the NCIS 26 January, 1999 press release are also weak evidence of law enforcement difficulties because they all involved cases in which law enforcement was successful in one way or another. Even without a "key escrow" or "key recovery" system, the law enforcement agents managed to decrypt the encrypted files in these cases.
Furthermore there is no justification for the DTI to cite the director of FBI within paragraph 50 of the consultation paper. The quote by Louis Freeh adds nothing solid to the weak evidence provided by the DTI to justify its goal and restrict the use of encryption.
There are also practical issues here which are worthy of consideration. Of course we are not in favour of terrorists and drug dealers using cryptography to plan or facilitate their crimes. But what if they do? The sending of messages in this way may still create evidence which is obtainable during the course of an investigation or trial. It is suspect users who should be targeted, not the whole world at large. We should also remember that government access to encryption keys, just as the use of other technological surveillance (such as Closed Circuit Television systems ("CCTVs") or explosives detection equipment and X-ray machines) have not prevented premeditated brutal terrorist attacks such as the Lockerbie Pan AM 103 bombing, and the London Docklands, and Manchester Arndale shopping centre bombings. It takes an extraordinarily high level of constant surveillance and oversight to provide an effective deterrent through these means.
More likely is that the terrorists will use encryption without detection or detection will come later through other means, by which time the refusal to provide the key will be incriminating evidence. Terrorists and organised criminals are detected through a variety of techniques involving mainly informers and surveillance. The interception of messages is important, but the police clearly have powers effective to build up other useful evidence.
Interception of Communications Act 1985
We refer here to paras. 55 et seq. of the consultation paper. The March 1997 DTI Consultation paper suggested that similar legislation to the Interception of Communications Act 1985 will be introduced for the recovery of keys from the TTPs. Similar calls are now being made by NCIS in addition to the DTI proposals. But this idea seems to go further than the requirements of the 1985 Act because the consultation paper suggested that the future legislation will not only deal with information on the move through a telecommunications system but also for "lawful access to data stored and encrypted by the clients of the licensed TTPs". Additionally, Internet communications are different from simple telephone communications, and the encryption technology in question is obviously not the medium itself, but a tool that can be used for many purposes. So the analogy with the Interception of Communications Act 1985 is not necessarily a correct one.
In developing its policy on encryption, the April 1998 Government Secure Electronic Statement relates that it has given serious consideration to the risk that criminals and terrorists will exploit strong encryption techniques to protect their activities from detection by law enforcement agencies. Therefore the government favours judicial warrants and legal interception of communications on a case by case basis. The policy paper stated that "the new powers will apply to those holding such information (whether licensed or not) and to users of encryption products." This is justified by the fact that warrants are regularly used for the interception of communications within Britain, although there is no claim that the interception of encrypted messages through the use of the Internet arose in any single case out of the 2600 interception warrants issued during 1996-97 by the Home Secretary. Another important issue to be noted is that the number of such warrants has risen considerably in the last few years (1073 warrants issued in 1996 compared to 473 in 1990). This suggests both that the current powers are more than adequate and perhaps also that they are not being properly or strictly regulated.
A further point which causes some alarm is that the government is not wholly committed to searches purely under the authority of a judge (contrary to earlier promises). In the Secure Electronic Statement, a vague distinction is made between judicial involvement in "criminal investigations" and other "interceptions" which will be by order of the Secretary of State. To some extent, it must be admitted that this follows the lax pattern of earlier legislation, but the replication of this absence of proper (judicial) oversight should hardly be welcome. The effect will be to dilute considerably judicial oversight, as law enforcement agencies will be encouraged to engage in "fishing expeditions" for intelligence which do not require scrutiny by judges. In any event, the access to a key in order to decode a message already sent should be treated as a different exercise to the original interception of a message as it is being transmitted. Once an encrypted message has been intercepted and found undecipherable, the benefits of real time access have already been lost, and the process of enforcing access becomes analogous to executing a search warrant. That analogy should be applied, thus ensuring that access powers are subject to judicial authority and that the additional protection provided by the Police and Criminal Evidence Act for "special procedure materials", such as legally privileged communications, are properly respected.
The interception of messages is an important technique of modern law enforcement, but it should be remembered that terrorists and organised criminals are detected through a variety of techniques involving mainly informers and surveillance. It should also be remembered that encryption is a means to an end and that at some stage a decrypted message is quite likely to be produced and recorded on computer or even in physical form by the criminal. In addition, those who choose to exercise their "right to silence" by not disclosing information to unlock encrypted files will risk adverse inferences being drawn from their silence under sections 34-37 of the Criminal Justice and Public Order Act 1994. Lord Slynn in Murray v. DPP stated that:
"If aspects of the evidence taken alone or in combination with other facts clearly call for an explanation which the accused ought to be in a position to give, if an explanation exists, then a failure to give any explanation may as a matter of common sense allow the drawing of an inference that there is no explanation and that the accused is guilty."
Not providing an encryption key may result in judges commenting on the accused’s behaviour and juries drawing inferences under the 1994 Act. An even more draconian power to order an explanation of seized materials (such as a computer disk) exists under Schedule 7 paragraph 6 of the Prevention of Terrorism (Temporary Provisions) Act 1989.
The PACE powers should remain the core powers to be relied upon by the police. They represent well-considered and, above all, principled powers which were passed in the light of a fully researched Royal Commission and long debate in Parliament.
We are not convinced that there should be any further powers to search. The main question is really whether there should be further obligations to disclose - as mentioned in paras.63 and 64 of the consultation paper. But we are not convinced of the need for extra powers. The failure to disclose may be a form of silence which can be commented upon under the Criminal Justice and Public Order Act 1994. It would be wrong to base any offence upon silence - apart from the inherent unsafeness of such a conviction, it would probably contravene article 6(2) of the European Convention. Why should suspects be under any greater obligation to aid the police with their inquiries in regard to their computer correspondence than with any other communications or actions? Our point again is that encryption should not be seen as inherently suspicious or a tool mainly of criminals.
Key escrow and key recovery by third parties
Without the "key recovery" capability, law enforcement agencies contend that they would be less able to protect the safety of the public, and this in itself would constitute an infringement of civil liberties. However, we believe that the solution to the problems of crime prevention and law enforcement do not lie with accessing private encryption keys. From our own research into recorded criminal uses of encryption, we have concluded that the use of encryption has not been a serious problem for crime detection or prevention. There is no more than speculation that it will be a problem in the future. In any event, it seems fanciful to expect that criminals will use government-mandated encryption systems with key recovery capabilities when alternative systems of encryption remain readily available. Government strategy would be naive if it assumed that criminals would use encryption tools which can be decrypted by the law enforcement bodies. In discussion, some Government spokesmen accept that criminals will communicate with one another securely outside any key escrow scheme. The point they make is that criminals communicating with innocent third parties who participate in a key escrow scheme will thereby expose those communications to interception. Innocent third parties are of course normally willing to assist law enforcement authorities by providing information, although in some cases they will rightly insist on police obtaining proper legal authority (the banks are the obvious example). If the police can obtain the information from innocent third parties by consent or through legal warrant, why do they need key escrow? We perceive that there are two possible reasons.
Moreover, a key escrow technology will have a chilling effect on the on-line users who seek to remain either secure or anonymous when communicating through the Internet, whether for fear of retribution or other reasons.
There is a need for dialogue between the police and the computer industry. It is an area where personal responsibility for personal security is feasible and desirable. So law enforcement agencies should be encouraging the use of encryption, just as better locks on cars, modified glass in beer glasses and so on have been developed by different industry sectors. In summary, the needs of law enforcement agencies are best met by preventing crime, and in regard to computer crime, encryption is an important way of preventing computer crime.
Written and Signed by
Mr Yaman Akdeniz, director
E-mail: lawya@cyber-rights.org
Professor Clive Walker, Deputy Director
E-mail: lawcpw@cyber-rights.org
Mr Nicholas Bohm, E-Commerce Policy Adviser
E-mail: nbohm@cyber-rights.org