Tech World recently reported that the UK police want to make it a criminal offense to withhold encryption keys. This is naturally in response to terrorism and other criminal activities which are making increased use of these privacy technologies.
I can understand why they would want such powers. With very little time, money, and effort, the average person can encrypt documents, files, and messages in a manner difficult if not impossible for most anyone to decrypt. This is law enforcement’s nightmare: seize a criminal’s computer, and not be able to extract any evidence from it.
The flip side of this issue is individual privacy. People should have the right to privacy, which is growing to become the most critical personal issue going into the 21st century. In our efforts to fight criminals, we must make sure we aren’t trouncing individual liberties at the same time, because once you start, you find it hard to arbitrarily stop.
But all that aside, I’m just wondering about this from the average computer user’s experience.
The way most encryption keys work is that there is a private key used to decrypt files, as well as a passphrase on that file. These two items are needed in order to decrypt something. If one or the other gets lost, then the file is unrecoverable. (Yes, there’s “conventional encryption” which just uses a passphrase and other forms of encryption, but that’s not what’s at issue here.)
This is all fine and good, but what if you’re the average end user? Have you ever forgotten a password? There’s a reason most sites have a little link marked “Forgot Password” — it’s not for aesthetics. Have you ever lost a file? Ever accidentally deleted one? Had a hard drive crash? Put it on a USB key and lost it? Reformatted your computer, forgetting to grab that file? This happens more often than many might think.
So, it’s very easy to lose both the file as well as the passphrase. It’s human nature. While one would hope that if you took the time and effort to encrypt something, you’d take measures to make sure you wouldn’t lose both, the average computer user tends to play things a little fast and loose.
Now, let’s say that you’ve done just that — played around with encrypting files a little bit, forgot about it, and lost the passphrase, the private key, or both. Entirely plausible; I’ve done both before. Then let’s say that you’re a suspect in an investigation, say, through racial profiling. (If you don’t think racial profiling is going on in this world right now, you’re being incredibly naive.) The police seize your computer, and demand that you hand over your encryption key, which you no longer have, so they charge you. Immediate criminal offense for being a little too lackadaisical. Making poor computer habits a crime is a bad thing. Especially when most computer users don’t have good computer habits.
This is all Big Brotherish, but as the EFF knows, it only takes a little bit to get the ball rolling on taking away civil liberties. One hopes that the UK will consider this as they work to increase policing powers.