NEWS RELEASE               Contact:	Caspar Bowden
Mon 28th Feb 2000     	            	director of FIPR
FOR IMMEDIATE USE			+44 (0)171 354 2333

The Government has not considered the problems and costs of handling
decryption keys when it takes new powers to seize them, says a nine-page
report (http://www.fipr.org/rip/RIPGAKBG.pdf) released today by the
influential Internet policy think-tank the Foundation for Information Policy
Research (FIPR). If the keys were disclosed, or even stolen from the
authorities that had seized them, then this could result in extreme risks to
physical safety and financial security. The new powers are in the
controversial Regulation of Investigatory Powers (RIP) Bill that receives
its second reading in the Commons on March 6th.

The report analyses the Government's proposals for safeguarding seized keys,
finding that they take no account of the technical security measures used by
government to protect their own keys, and make no provision whatsoever for
keys seized under RIP to enjoy comparable levels of protection. Hundreds of
public authorities are able to demand keys (set out over five pages in
Schedule.1), but none are required to take concrete security precautions on
behalf of those who are forced to reveal their keys - whether suspect or
innocent parties in an investigation.

The report concludes that the necessary protection measures will be very
costly to implement and are hence likely to place a very high burden on UK
taxpayers if the interests of the owners of seized keys are to be fully
respected.  It concludes that there is a danger that the costs of such
measures will not be met and in consequence those who have their keys seized
will sometimes face extreme risks to their safety and security.

Caspar Bowden, director of FIPR, said "either the Home Office has completely
overlooked the issue of technical security for keys seized by a multitude of
public authorities, or Parliament is being hopelessly misled about the costs
of implementation. When mandatory escrow was proposed three years ago, the
DTI judged then that a 'central repository' would be needed to receive and
guard keys" (para.71 - 'Licensing of TTPs for the Provision of Encryption
Services', DTI 1997.)

Nicholas Bohm, a solicitor and member of the Law Society's Electronic
Commerce Working Party, commented "the government evidently thinks that it
will be satisfactory for anyone with a seized key, from a policeman to a
trading standards officer, to lock a floppy disk away in the top drawer of
their desk".

Dr Brian Gladman, the report's author, commented, "the government knows the
importance of protecting keys and yet it has chosen to keep Parliament in
the dark; it is hard not to conclude that this is a desperate attempt to
prevent an unworkable policy from collapsing under the weight of its own

Notes for editors
1.	Clause 51 of the Bill, which is intended to provide key custody
safeguards, contains no provision requiring adequate technical security
precautions, and the Regulatory Impact Assessment  provided by the Home
Office (http://www.homeoffice.gov.uk/oicd/riapt3.htm) merely states that
"providing actual figures on compliance costs is difficult at this stage".

2.	The reports author is FIPR Advisory Council member Brian Gladman, an
internationally recognised leader in the field of information security who
has more than 25 years of experience in the UK Ministry of Defence and NATO
in the technologies and techniques required to build computer systems in
which safety and security are critical requirements.

3.	FIPR is an independent non-profit organisation that studies the
interaction between information technology and society, with special
reference to the Internet; we do not (directly or indirectly) represent the

interests of any trade-group. Our goal is to identify technical developments
with significant social impact, commission research into public policy
alternatives, and promote public understanding and dialogue between
technologists and policy-makers in the UK and Europe. The Board of Trustees
and Advisory Council (http://www.fipr.org/trac.html) comprise some of the
leading experts in the UK.

Go to FIPR front page.

Return to FIPR RIP Information Centre.