EU: Battle over E-Mail Encryption Key

11 March 1998
Source: Anonymous

3/5/98

EU: BATTLE OVER E-MAIL ENCRYPTION KEY.

By Simon Coss

THE UK is calling on all EU member states to allow police forces to carry out covert surveillance of encrypted e-mail correspondence.

In a report to a recent meeting of top EU police officials, the UK presidency argued that in certain circumstances law enforcement agencies should be permitted to tap scrambled electronic messages being passed through open networks such as the Internet.

This would be done by obliging all individuals who use encryption software to provide the police with an electronic key to unlock scrambled messages:

"Where an encryption key is used for confidentiality purposes, it may be necessary for law enforcement agencies to have lawful access in certain circumstances. This access may need to be either overt or covert," argues the report.

Supporters of the 'back-door key' approach maintain that law enforcement agencies must be allowed fast access to encrypted e-mail correspondence in order to combat the increasingly sophisticated communications methods used by criminal organisations and terrorists.

EU law and order experts point to a number of recent high-profile successes in criminal investigations which would have proved much harder to achieve if the police had not had such powers.

These include the 1995 poison gas attack carried out by the Aum Supreme Truth cult on a Tokyo subway (encrypted files found on the organisation's computer were used as evidence); the case of Aldrich Ames, the CIA agent-turned-spy who used encryption software to protect his files; and an investigation into a Bolivian terrorist group which led to one of that country's biggest-ever drugs hauls. The Italian authorities have also warned that the Mafia is increasingly using encryption software.

But opponents say what London is proposing has serious implications for civil liberties within the Union, could strangle the emerging electronic commerce industry at birth and will not enable the police to catch many more crooks.

"Without strong encryption, businesses and individuals will not entrust their valuable proprietary information, creative content and sensitive personal information to electronic networks," said a recent statement from the Business Software Alliance, which counts industry giants Microsoft, Adobe Systems and Symantec among its members.

"The result will be that the full potential for electronic commerce, personal growth and government efficiency and other benefits of the information society will be delayed or lost altogether."

The European Commission and the Organisation for Economic Cooperation and Development (OECD) have both argued that the disadvantages of allowing the police to access encrypted messages far outweigh the benefits.

The Commission points out that suspected criminals are, by definition, already known to the authorities and argues that any encrypted information they may send will almost certainly exist in an unscrambled form at a location already being watched.

In addition, officials at the institution have warned that EU governments could face a legal challenge in the European Court of Justice if they introduce 'disproportionate' rules which interfere with the single market in electronic services. Essentially, this means the Commission has the right to act if it feels governments are using a sledgehammer to crack a nut.

"No one is asking people to hand over the spare keys to their houses just because one in 20,000 people might turn out to be a criminal," explained one official. "Whatever the law enforcement agencies want, we only have one treaty. There are no exceptions because the police are in a hurry."

Civil liberties campaigners argue that if the police really want to monitor encrypted correspondence, they should apply for a warrant on a case-by-case basis.

"They want more than warranted access. They want to monitor activity immediately. This is very worrying. It is a step closer to the idea of the 'big brother' state," said Yaman Akdeniz of UK-based Cyber Rights and Cyber Liberties.

---