Feeds

UK unveils proposed crypto law

Key escrow no longer mandatory

  • alert
  • submit to reddit

New hybrid storage solutions

The British Government has released its latest draft proposals for the regulation of strong encryption technologies, in preparation for the upcoming Electronic Commerce Bill. As anticipated (see earlier story), companies seeking to become licensed providers of encryption technology will no longer have to agree to key escrow. The proposals, presented as a consulation paper, seek to build trust in e-commerce transactions by establishing a voluntary licensing scheme for providers of cryptography services and ensuring that digital transactions are as legally binding as those made by other methods of communication. In respect to the latter, the government said it will consider removing obstacles in exisiting legislation that may result in electronic communications not being on a legal par with other media. The licensing scheme separates the provision and certification of digital signatures from the provision of data encryption services and technology. Companies offering either or both of these services would not be required to become licensed, but the government hopes that most will, under consumer pressure. Unlicensed providers' products will still be recognised under the law -- using one will simply require users to prove the products are up to scratch in the case of legal action; confidence in 'official' services can be taken as read. The government was quick to point out that licensed cryptography providers will not be forced to install a key recovery policy. Actually, there's some subtle word-play here. The government says it is consulting with the public on the basis that key escrow will not be mandatory. That doesn't mean key escrow is dead and that it will never be implemented in legislation. Indeed, the consultation document admits that the government will be monitoring its 'no escrow' policy, and it's clear that if it finds that police operations are being hampered by the legislation as it stands (or will stand, once the Bill is enacted), then it will change the rules. For the moment, the government believes the law enforcement and security forces are granted sufficient access to encrypted data under existing legislation. Again, however, it admits that might change. The Department of Trade and Industry is seeking comments from the public and industry on all of its proposals. The deadline for comments is 1 April 1999. The full consultation document, in PDF form, can be viewed here. ®

The next step in data security

More from The Register

next story
Phones 4u slips into administration after EE cuts ties with Brit mobe retailer
More than 5,500 jobs could be axed if rescue mission fails
JINGS! Microsoft Bing called Scots indyref RIGHT!
Redmond sporran metrics get one in the ten ring
Driving with an Apple Watch could land you with a £100 FINE
Bad news for tech-addicted fanbois behind the wheel
Murdoch to Europe: Inflict MORE PAIN on Google, please
'Platform for piracy' must be punished, or it'll kill us in FIVE YEARS
Phones 4u website DIES as wounded mobe retailer struggles to stay above water
Founder blames 'ruthless network partners' for implosion
Found inside ISIS terror chap's laptop: CELINE DION tunes
REPORT: Stash of terrorist material found in Syria Dell box
Sony says year's losses will be FOUR TIMES DEEPER than thought
Losses of more than $2 BILLION loom over troubled Japanese corp
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Protecting users from Firesheep and other Sidejacking attacks with SSL
Discussing the vulnerabilities inherent in Wi-Fi networks, and how using TLS/SSL for your entire site will assure security.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.