JILT 1997 (3) - Law Society Response
The Law Society of England and Wales Response (Summary)
to the DTI Consultation Paper
Licensing of Trusted Third Parties for the Provision of Encryption Services
The full response is available at http://www.spesh.com/crypto/lawsoc.html
This Comment was published on 9 July 1997.
Citation: Law Society of England and Wales, 'Response to the DTI Consultation Paper, Comment, 1997 (3) The Journal of Information, Law and Technology (JILT). <http://elj.warwick.ac.uk/jilt/Consult/ukcryp/lawsoc.htm>. New citation as at 1/1/04: <http://www2.warwick.ac.uk/fac/soc/law/elj/jilt/1997_3/lawsociety/>
1. Introduction
1.The second part of this paper sets out our comments on the issues listed in Section VII of the Consultation Paper.
We should however like to begin with three general points. These can be summarised thus:
a) We are not persuaded by the arguments put forward in the Consultation Paper that there is a convincing case for the introduction of a Trusted Third Party system;
b) there would, in our view, be value in legislation on the validity of “electronic signatures”: and
c) if the Trusted Third Party system is introduced, eligibility to be a TTP should not, either theoretically or in practice, be confined to telecommunications providers.
First point: a) As to the first of these observations: we understand the proposed TTP system as being intended to serve two purposes: one, as a support for those who make use of encryption for legitimate commercial (and perhaps also private) purposes: and, second, as a deterrent to the use of encryption for the furtherance of crime.
We doubt that the proposed system would be effective for either purpose.
The Paper says (para.42) that 'TTPs will allow UK Business to take advantage of secure electronic trading'. We find it difficult to think of reasons why those who use encryption in the course of business would want to make use of TTPs’ services. To do so would create a security risk by giving the capacity to decrypt information to others outside the control of the sender and intended receiver, thereby increasing the number of those with access to it, without, as we see it, any material corresponding benefit.
In our view. the very great majority of encryption users would not want to give any outsider information which could allow access to their encrypted material, however apparently trustworthy the outsider. They would rely on contractual arrangements with those with whom they wanted to communicate and which did not require the disclosure of their keys to anyone else.
Use of the TTP system would, we suggest, give rise to a security risk which could be of a significant kind. The TTP’s arrangements for preventing access to its records by any but authorised staff would need to be highly effective - and, if the system was used to any significant extent, the value of the stored information could be great, making it an attractive target for organised crime, perhaps with substantial resources at its disposal; and breach of a system’s security would not only give access to information but could give the intruder the power to alter and forge messages.
TTPs' defences against security breaches would need to start with their procedures for verifying the identity of key depositors. Unless they made rigorous identity checks, fraudulent depositors would be able to use them for endorsement of false identities, another potentially profitable avenue for misuse of the system. Rigorous identity checking is expensive: passports and other documents usually used to prove identity may be false or forged, and thorough personal enquiries is needed.
To overcome the disadvantage of the security risk which the TTP system would pose for users, it would, we suggest, have to offer very substantial benefits to encourage its use. We find it difficult to see what these could be.
For example, the Paper says (para. 36) that 'Private parties may also have legitimate reasons and a legal basis to obtain access to encrypted information. For instance, an employee who has encrypted files may resign without leaving information concerning the private key, or the death of an individual may require a solicitor to have access to their encrypted information' which may require resort to a TTP. We find this difficult to accept: surely no organisation would allow an employee to encrypt information in such a way that it was inaccessible to the organisation other than through the employee; and it seems to us improbable that an individual would be so perverse as to arrange his or her affairs in such a way that his or her personal representative could get access to information which the deceased wanted him to have only by resorting to a TTP.
The Paper also says (Annex F) that an advantage of the TTP system will be that 'Secure communications between unknown parties. without the need to depend on either expensive or multiple solutions will become common place and thus lead to increased confidence and use of the information society.' We question the assumption underlying this assertion that there is a demand of any significant extent for a secure system for communications between people who are unknown to each other. In our view. the great majority of situations in which people want to exchange information in confidence involve two or more participants each of which is known to at least one, if not all, of the others. We find it difficult to think of situations in which people unknown to each other might need to communicate confidentially in such a way as to make the use of a TTP desirable, or indeed practicable.
The reluctance to use TTPs would, in our view, apply eyen more strongly to those using encryption for illegal purposes. The Paper does not provide a convincing explanation of how the TTP system would deter the use of encryption in the furtherance of crime. Annex F asks the question why, if the system is not to be mandatory, will 'crooks and terrorists' not use something else, and puts forward as an answer that 'Criminals will often make use of whatever technology is conveniently available to them'. It goes on to state that 'We expect TTPs to have a major role in conveying secure electronic communications, especially where a payment for legitimate services is involved.' This does not seem to us to answer the question: it seems obvious that 'crooks and terrorists' will use 'something else' to avoid handing over keys to anyone who might in turn hand them over to the law enforcement authorities and we do not see how the existence of the TTP regime will discourage, let alone prevent, it.
Second point: b) this relates to electronic signatures, or authentication of documents. Rightly, the Consultation Document does not propose that keys used for 'integrity functions' - which we take to cover keys used solely to indicate documents' authenticity and their senders' identity - should have to be deposited with TTPs. However. one of the questions asked in the Paper is whether legislation to introduce 'some form of rebuttable presumption' for the recognition of electronic signatures would be useful.
As we have said, we think that it would be. Large numbers of commercial transactions are already carried out in reliance on electronic 'signatures', for example, contractual offers and acceptances made by fax or other electronic medium, and many users of these systems have contractual arrangements for this purpose. However, the status of documents 'signed' in this way is uncertain, particularly where the law requires a particular document to be signed, or a type of transaction to be recorded in writing.
Some form of legislative recognition of the validity of an electronic 'signature' which was the result of an agreed procedure would be helpful to commerce; and also a clarification of the law on how requirements for writing might be complied with in electronic communications.
We do not believe that this need be a 'massive undertaking' or that it need involve 'reviewing all existing legislation', as para. 51 of the Paper says. A general presumption could be set up without difficulty, and the various situations where the law imposes particular requirements could be dealt with piecemeal, starting only with the more obvious and widely applicable situations.
Third point: c) We understand that the Government see Trusted Third Party services as being provided by telecommunications companies. If our doubts about the viability of the TTP system are unfounded and there is a demand for TTP services, we think that, though telecommunications companies may want to provide them. it would be wrong to confine eligibility to companies of this kind and that the legislation introducing the system should be designed so as to enable others to qualify. Solicitors' firms with commercial clienteles might want to be able to provide these services and the same could apply to accountancy firms.
We think that it would be a grave mistake to design the new structure so as to confine the availability of TTP status to telecommunications companies.
