Key disclosure laws, also known as mandatory key disclosure, is legislation that requires individuals to surrender cryptographic keys to law enforcement. The purpose is to allow access to material for confiscation or digital forensics purposes and use it either as evidence in a court of law or to enforce national security interests. Similarly, mandatory decryption laws force owners of encrypted data to supply decrypted data to law enforcement.
Nations vary widely in the specifics of how they implement key disclosure laws. Some, such as Australia, give law enforcement wide-ranging power to compel assistance in decrypting data from any party. Some, such as Belgium, concerned with self-incrimination, only allow law enforcement to compel assistance from non-suspects. Some require only specific third parties such as telecommunications carriers, certification providers, or maintainers of encryption services to provide assistance with decryption. In all cases, a warrant is generally required.
Theory and countermeasures Mandatory decryption is technically a weaker requirement than key disclosure, since it is possible in some cryptosystems to prove that a message has been decrypted correctly without revealing the key. For example, using RSA public-key encryption, one can verify given the message (plaintext), the encrypted message (ciphertext), and the public key of the recipient that the message is correct by merely re-encrypting it and comparing the result to the encrypted message. Such a scheme is called undeniable, since once the government has validated the message they cannot deny that it is the correct decrypted message.Desmedt, Yvo and Burmester, Mike and Seberry, Jennifer. Equitability in Retroactive Data Confiscation versus Proactive Key Escrow. Florida State University Department of Computer Science 206 Love Building FL 32306-4530 Tallahassee USA. Lecture Notes in Computer Science: Public Key Cryptography, pp.277-286. 2001. (Postscript), (Postscript 2)
As a countermeasure to key disclosure laws, some personal privacy products such as BestCrypt, FreeOTFE, and TrueCrypt have begun incorporating deniable encryption technology, which enable a single piece of encrypted data to be decrypted in two or more different ways, creating plausible deniability.Plausible Deniability Another alternative is steganography, which hides encrypted data inside of benign data so that it is more difficult to identify in the first place.
A problematic aspect of key disclosure is that it leads to a total compromise of all data encrypted using that key in the past or future; time-limited encryption schemes such as those of Desmedt et al. allow decryption only for a limited time period.
Criticism and alternatives Critics of key disclosure laws view them as compromising information privacy, by revealing personal information that may not be pertinent to the crime under investigation, as well as violating the right against self-incrimination and more generally the right to silence, in nations which respect these rights. In some cases, it may be impossible to decrypt the data because the key has been lost, forgotten or revoked, or because the data is actually random data which cannot be effectively distinguished from encrypted data.
A proactive alternative to key disclosure law is key escrow law, where the government holds in escrow a copy of all cryptographic keys in use, but is only permitted to use them if an appropriate warrant is issued. Key escrow systems face difficult technical issues and are subject to many of the same criticisms as key disclosure law; they avoid some issues like lost keys, while introducing new issues such as the risk of accidental disclosure of large numbers of keys, theft of the keys by hackers or abuse of power by government employees with access to the keys. It would also be nearly impossible to prevent the government from secretly using the key database to aid mass surveillance efforts such as those exposed by Edward Snowden. The ambiguous term key recovery is applied to both types of systems.
Legislation by nation This list shows only nations where laws or cases are known about this topic. Antigua and Barbuda
The Computer Misuse Bill, 2006, Article 21(5)(c), if enacted, would allow police with a warrant to demand and use decryption keys. Failure to comply may incur "a fine of fifteen thousand [East Caribbean] dollars" and/or "imprisonment for two years."
Australia
The Cybercrime Act 2001 No. 161, Items 12 and 28 grant police with a magistrate's order the wide-ranging power to require "a specified person to provide any information or assistance that is reasonable and necessary to allow the officer to "access computer data that is "evidential material"; this is understood to include mandatory decryption. Failing to comply carries a penalty of 6 months' imprisonment. Electronic Frontiers Australia calls the provision "alarming" and "contrary to the common law privilege against self-incrimination."Electronic Frontiers Australia. Privacy Laws in Australia: Security / Cybercrime. Retrieved 2010 November 8.
The Crimes Act 1914, 3LA(5) "A person commits an offence if the person fails to comply with the order. Penalty for contravention of this subsection: Imprisonment for 2 years."
Belgium
The Loi du 28 novembre 2000 relative à la criminalité informatique (Law on computer crime of 28 November 2000), Article 9 allows a judge to order the authorities to search the computer systems and telecommunications providers to provide assistance to law enforcement, including mandatory decryption, and to keep their assistance secret; but this action cannot be taken against suspects or their families.Loi du 28 novembre 2000 relative à la criminalité informatique: Article 9. 2000 November 28. Retrieved 2010 November 9. (The investigating judge may order any appropriate person to put the computer system into operation himself or, as the case may be, to search for, make available, copy, render inaccessible or remove the relevant data stored, processed or transmitted by that system, in the form he has requested. Such persons shall be obliged to comply with such requests to the extent of their ability.)Code d'instruction criminelle. Livre II, titre I, Art. 156. 1808 November 19. Retrieved 2010 November 9. (in French) Failure to comply is punishable by 6 months to 1 year in jail and/or a fine of 130 to 100,000 euros.
Cambodia Cambodia promulgated its Law on Electronic Commerce on 2 November 2019, after passage through legislature and receiving consent from the monarch, becoming the last among ASEAN states to adopt a domestic law governing electronic commerce. Article 43 of the statute prohibits any encryption of evidence in the form of data that could lead to an indictment, or any evidence in an electronic system that relates to an offense. This statutory obligation may imply that authorities could order decryption of any data implicated in an investigation. While remaining untested in courts, this obligation actively contradicts an accused person's procedural right against self-incrimination as provided under Article 143 of the Code of Criminal Procedure.
Canada In Canada key disclosure is covered under the Canadian Charter of Rights and Freedoms section 11(c) which states "any person charged with an offence has the right not to be compelled to be a witness in proceedings against that person in respect of the offence;"Your Guide to the Canadian Charter of Rights and Freedoms. Government of Canada. Last modified 2017 October 24. Retrieved 2018 January 29. and protects the rights of individuals that are both citizens and non-citizens of Canada as long as they are physically present in Canada.Singh Case. The Canadian Encyclopedia. Last modified 2017 August 6. Retrieved 2018 January 29.
In a 2010 Quebec Court of Appeal case the court stated that a password compelled from an individual by law enforcement "is inadmissible and that renders the subsequent seizure of the data unreasonable. In short, even had the seizure been preceded by judicial authorization, the law will not allow an order to be joined compelling the respondent to self-incriminate."R. c. Boudreau-Fontaine, 2010 QCCA 1108 (CanLII). Quebec Court of Appeal. 2010 June 9. Retrieved 2018 January 29.
In a 2019 Ontario court case (R v. Shergill), the defendant was initially ordered to provide the password to unlock his phone. However, the judge concluded that providing a password would be tantamount to self-incrimination by testifying against oneself. As a result, the defendant was not compelled to provide his password.
Czech Republic
In the Czech Republic there is no law specifying obligation to issue keys or passwords. Law provides protecting against self-incrimination, including lack of penalization for refusing to answer any question which would enable law enforcement agencies to obtain access to potential evidence, which could be used against testifying person.
Finland
The Coercive Measures Act (Pakkokeinolaki) 2011/806 section 8 paragraph 23 requires the system owner, its administrator, or a specified person to surrender the necessary "passwords and other such information" in order to provide access to information stored on an information system. The suspect and some other persons specified in section 7 paragraph 3 that cannot otherwise be called as witnesses are exempt from this requirement.
France (Law #2001-1062 of 15 November 2001 on Community Safety) allows a judge or prosecutor to compel any qualified person to decrypt or surrender keys to make available any information encountered in the course of an investigation. Failure to comply incurs three years of jail time and a fine of €45,000; if the compliance would have prevented or mitigated a crime, the penalty increases to five years of jail time and €75,000.Articles 30–31,
Germany
The German Code of Criminal Procedure grants a suspect the right to deny cooperation in an investigation that may lead to incriminating information to be revealed about themselves. For private usage is no legal basis that would compel a suspect to hand over any kind of cryptographic key due to this nemo tenetur principle.Government Access to Encrypted Communications: Germany. 2016 October 01. Retrieved 2017 December 6.
Hong Kong
In Hong Kong, police can demand passwords under the amended 2020 Hong Kong national security law. Failure to comply could be punished by up to one year in jail and a fine of up to HK$100,000.
Iceland
In Iceland there is no law specifying obligation to issue keys or passwords.
India
Section 69 of the Information Technology Act, as amended by the Information Technology (Amendment) Act, 2008, empowers the central and state governments to compel assistance from any "subscriber or intermediary or any person in charge of the computer resource" in decrypting information.Information Technology (Amended) Act, 2008 (PDF); Government of India – Ministry of Law, Justice and Company Affairs (Legislative Department); XI (69) pp. 27–8.Paper – 6 : Information Systems Control and Audit (PDF) 10 pp. 42–3. Study Material - Final (New) The Institute of Chartered Accountants of India. Failure to comply is punishable by up to seven years' imprisonment and/or a fine.
Ireland Section 7(4)(b) of the Criminal Justice (Offences Relating to Information Systems) Act 2017 allows a member of the Garda Síochána or other persons as deemed necessary (via a search warrant issued by a judge of the District Court (Section 7(1))) to demand the disclosure of a password to operate a computer and any decryption keys required to access the information contained therein.7(4) A member acting under the authority of a search warrant under this section may—
(a) operate any computer at the place that is being searched or cause any such computer to be operated by a person accompanying the member for that purpose, and