Feeds

RIPA III: A legislative turkey comes home to roost

The tragic consequences of anti-crypto law

SANS - Survey on application security programs

Comment The first conviction of a man under the draconian powers of RIPA Part III tragically bears out a prediction I made at the time: that these powers would do little or nothing to tackle serious crime or terror, but would create a power the police could use to harass people and undermine their right to remain silent.

After all, a hardened criminal can use deniable encryption, or claim to have forgotten the password; the likely victims would be the less organised and the vulnerable.

And so it has turned out. The first person convicted under this law was a vulnerable eccentric who refused to decrypt the files on his laptop when the Met's terror squad told him to. He was convicted and jailed despite prosecutors accepting that he was not involved in terrorism at all. He is now in a mental hospital.

Old-timers will remember the crypto wars of the 1990s. The US government tried to force everyone to use the Clipper chip, an encryption device for which they had a back-door key. When cryptographers broke the Clipper chip, Washington tried to make cryptography illegal unless the keys were deposited with a 'trusted third party' from whom the police could obtain keys secretly using a warrant.

Cryptographers and computer companies fought back, complaining of the threat to privacy, the chilling effect on e-commerce and the cost. Eventually the chief crypto warrior, Al Gore, dropped the issue during his presidential campaign in an attempt to curry favour with the industry.

As sometimes happens, US policy had toxic effects here. In 1996, trade minister Ian Taylor laid a trap for the opposition by talking of government control of cryptography. His shadow Chris Smith was not to be outdone at the 'tough on crime' game, and promised that New Labour would require people to hand over keys so that paedophiles could not escape surveillance.

This raised a storm of protest from geeks and from the IT industry, which had been cosying up to New Labour in the belief they’d win the 1997 election. Anne Campbell, the MP for Cambridge, ended up in charge of the issue as back then she was the only Labour MP with a publicly visible email address that she actually answered.

The compromise that appeared among New Labour’s election promises was a power to compel decryption of seized material. Taylor then calmly said that he'd changed his mind; crypto control was not necessary.

This nifty piece of political footwork was not enough to save John Major, though, and Labour's election promise duly arrived as Part III of the Regulation of Investigatory Powers Act 2000.

Blair initially tried for even more macho controls on crypto, but these were undermined by UK crypto campaigners, by the Gore U-turn, and by an EU ruling that keys would only be good for digital signatures if only the signer had a copy. So the bill's passage through Parliament was turbulent; there was much talk of serious crime and of terror. But even despite the events of 2001, Part III was not actually brought into force until 2007.

The whole business brings to mind a comment attributed to Bismarck: "Laws are like sausages – it's best not to watch them being made." ®

Copyright Ross Anderson 2009. Ross Anderson is Professor of Security Engineering at the University of Cambridge Computer Laboratory.

High performance access to file storage

More from The Register

next story
Did a date calculation bug just cost hard-up Co-op Bank £110m?
And just when Brit banking org needs £400m to stay afloat
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
MtGox chief Karpelès refuses to come to US for g-men's grilling
Bitcoin baron says he needs another lawyer for FinCEN chat
Don't let no-hire pact suit witnesses call Steve Jobs a bullyboy, plead Apple and Google
'Irrelevant' character evidence should be excluded – lawyers
EFF: Feds plan to put 52 MILLION FACES into recognition database
System would identify faces as part of biometrics collection
Lavabit loses contempt of court appeal over protecting Snowden, customers
Judges rule complaints about government power are too little, too late
Whoever you vote for, Google gets in
Report uncovers giant octopus squid of lobbying influence
Ex-Tony Blair adviser is new top boss at UK spy-hive GCHQ
Robert Hannigan to replace Sir Iain Lobban in the autumn
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Alphadex fires back at British Gas with overcharging allegation
Brit colo outfit says it paid for 347KVA, has been charged for 1940KVA
prev story

Whitepapers

Designing a defence for mobile apps
In this whitepaper learn the various considerations for defending mobile applications; from the mobile application architecture itself to the myriad testing technologies needed to properly assess mobile applications risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.