Section 41 of The Computer Misuse Act, currently winging its way through the Lords, has the following clause:
A person is guilty of an offence if he makes, adapts, supplies or offers to supply any article —
(a) intending it to be used to commit, or to assist in the commission of, an offence under section 1 or 3 [of the Computer Misuse Act]; or
(b) believing that it is likely to be so used.
So if I were to write a packet snooping program to scan my network for Trojans or other suspicious traffic, I would unwittingly fall foul of this clause. I would have invented something that a criminal could use to scan network traffic and steal valuable information.
Everybody accepts that knives and guns are lethal weapons but we would never expect to see the authorities prosecute the companies who manufacture them. Why then, are computer programmers different?
If you think that is bad then how would you feel about being sent to jail for forgetting you password? The government is now in the process of activating Part 3 of the Regulation of Investigatory Powers Act (RIP) giving law enforcement officers the authority to order the disclosure of decryption keys, or force suspects to decrypt encrypted data. Failure to hand over a key could land you in jail for 2 years. If your enrypted data turned out to be incriminating evidence that could put you away for much longer… let’s just say that even John Prescott could figure out that little conundrum.
If Part 3 is passed, financial institutions could be compelled to give up the encryption keys they use for banking transactions, experts have warned.
Our last hope is to cling to the notion that in the end, this law will be completely un-enforcable:
“It is, as ever, almost impossible to prove ‘beyond a reasonable doubt’ that some random-looking data is in fact ciphertext, and then prove that the accused actually has the key for it, and that he has refused a proper order to divulge it,” pointed out encryption expert Peter Fairbrother on ukcrypto, a public email discussion list.
Clayton backed up this point. “The police can say ‘We think he’s a terrorist’ or ‘We think he’s trading in kiddie porn’, and the suspect can say, ‘No, they’re love letters, sorry, I’ve lost the key’. How much evidence do you need [to convict]? If you can’t decrypt [the data], then by definition you don’t know what it is,” said Clayton.
I guess I could offer to write a program that could employ complex pattern matching algorithms in an attempt to identify the data and figure out the type of encryption being used, but if I do that I might fall foul of the Section 41 of the Computer Misuse Act. Bummer.