subject: (Fwd) FC: UK think tank criticizes government crypto-key safeg posted: Tue, 29 Feb 2000 23:52:19 +0800
Mandatory escrow? Just Say No.
------- Forwarded message follows -------
Date sent: Tue, 29 Feb 2000 08:10:08 -0500
To: [email protected]
From: Declan McCullagh <[email protected]>
Subject: FC: UK think tank criticizes government crypto-key safeguards
Send reply to: [email protected]
>From: "Caspar Bowden" <[email protected]>
>Subject: FIPR News Release: RIP BILL LEAVES SEIZED KEYS VULNERABLE
>Date: Mon, 28 Feb 2000 16:34:10 -0000
>
>IF YOU ARE WAITING FOR FIPR's FULL R.I.P. ANALYSIS
>+ DRAFT AMENDMENTS - PLEASE BE PATIENT, IT'S IN THE WORKS
>
>NEWS RELEASE Contact: Caspar Bowden
>Mon 28th Feb 2000 director of FIPR
>FOR IMMEDIATE USE +44 (0)171 354 2333
> [email protected]
>
>RIP BILL LEAVES SEIZED KEYS VULNERABLE
>======================================
>The Government has not considered the problems and costs of handling
>decryption keys when it takes new powers to seize them, says a nine-page
>report (http://www.fipr.org/rip/RIPGAKBG.pdf) released today by the
>influential Internet policy think-tank the Foundation for Information Policy
>Research (FIPR). If the keys were disclosed, or even stolen from the
>authorities that had seized them, then this could result in extreme risks to
>physical safety and financial security. The new powers are in the
>controversial Regulation of Investigatory Powers (RIP) Bill that receives
>its second reading in the Commons on March 6th.
>
>The report analyses the Government's proposals for safeguarding seized keys,
>finding that they take no account of the technical security measures used by
>government to protect their own keys, and make no provision whatsoever for
>keys seized under RIP to enjoy comparable levels of protection. Hundreds of
>public authorities are able to demand keys (set out over five pages in
>Schedule.1), but none are required to take concrete security precautions on
>behalf of those who are forced to reveal their keys - whether suspect or
>innocent parties in an investigation.
>
>The report concludes that the necessary protection measures will be very
>costly to implement and are hence likely to place a very high burden on UK
>taxpayers if the interests of the owners of seized keys are to be fully
>respected. It concludes that there is a danger that the costs of such
>measures will not be met and in consequence those who have their keys seized
>will sometimes face extreme risks to their safety and security.
>
>Caspar Bowden, director of FIPR, said "either the Home Office has completely
>overlooked the issue of technical security for keys seized by a multitude of
>public authorities, or Parliament is being hopelessly misled about the costs
>of implementation. When mandatory escrow was proposed three years ago, the
>DTI judged then that a 'central repository' would be needed to receive and
>guard keys" (para.71 - 'Licensing of TTPs for the Provision of Encryption
>Services', DTI 1997.)
>
>Nicholas Bohm, a solicitor and member of the Law Society's Electronic
>Commerce Working Party, commented "the government evidently thinks that it
>will be satisfactory for anyone with a seized key, from a policeman to a
>trading standards officer, to lock a floppy disk away in the top drawer of
>their desk".
>
>Dr Brian Gladman, the report's author, commented, "the government knows the
>importance of protecting keys and yet it has chosen to keep Parliament in
>the dark; it is hard not to conclude that this is a desperate attempt to
>prevent an unworkable policy from collapsing under the weight of its own
>incompetence."
>
>Notes for editors
>-----------------
>1. Clause 51 of the Bill, which is intended to provide key custody
>safeguards, contains no provision requiring adequate technical security
>precautions, and the Regulatory Impact Assessment provided by the Home
>Office (http://www.homeoffice.gov.uk/oicd/riapt3.htm) merely states that
>"providing actual figures on compliance costs is difficult at this stage".
>
>2. The reports author is FIPR Advisory Council member Brian Gladman, an
>internationally recognised leader in the field of information security who
>has more than 25 years of experience in the UK Ministry of Defence and NATO
>in the technologies and techniques required to build computer systems in
>which safety and security are critical requirements.
>
>3. FIPR is an independent non-profit organisation that studies the
>interaction between information technology and society, with special
>reference to the Internet; we do not (directly or indirectly) represent the
>
>interests of any trade-group. Our goal is to identify technical developments
>with significant social impact, commission research into public policy
>alternatives, and promote public understanding and dialogue between
>technologists and policy-makers in the UK and Europe. The Board of Trustees
>and Advisory Council (http://www.fipr.org/trac.html) comprise some of the
>leading experts in the UK.
--------------------------------------------------------------------------
POLITECH -- the moderated mailing list of politics and technology
To subscribe: send a message to [email protected] with this text:
subscribe politech
More information is at http://www.well.com/~declan/politech/ --------------------------------------------------------------------------
------- End of forwarded message -------
generated by msg2page 0.06 on Jul 21, 2006 at 19:05:17
search: