Everyone charged with a penal offence has the right to be presumed innocent until proved guilty according to law in a public trial at which he has had all the guarantees necessary for his defence. No one shall be held guilty of any penal offence on account of any act or omission which did not constitute a penal offence, under national or international law, at the time when it was committed. Nor shall a heavier penalty be imposed than the one that was applicable at the time the penal offence was committed. (Article 11 UDHR)

Crypto Regulation in Europe.
Some key trends and issues

Proceedings 8^th Joint European Networking Conference,
Edinburgh, 12-15 May 1997, pp. 811/1-8

© Bert-Jaap Koops, May 1997

This page may not be redistributed. Permission is granted for printing one copy for personal use. Please credit if quoting.

A somewhat revised version of this paper, updated until June 1997, was published in Computer Networks and ISDN Systems 19 (1997), p. 1823-1831

Abstract

I. Introduction

The problem is that not only good guys use it - criminals and terrorists may take advantage of the concealing merits of cryptography to remain out of reach from wiretapping officials. It is because of this nefarious use of cryptography that governments have long restricted its export, and are now also considering to regulate its use domestically. Law enforcement increasingly worries over the potential of cryptography to thwart wiretapping and searches and seizures. When a bomb explodes, national security experts are heard complaining about the free availability of cryptography. In short, governments face a dilemma of choosing between promoting crypto use to protect vital economic and privacy-related information on the one hand, and stopping criminals and terrorists from using it on the other hand.

In this paper, I shall sketch how governments in Europe (and in the US, for in these matters, one cannot overlook what the US are doing) are trying to tackle this dilemma. I shall pay particular attention to the recent attempt by the OECD to create international guidelines for crypto policies. From this brief survey, I shall distill some key trends in crypto regulation. Then, I shall have a critical look at these trends, and indicate some major issues that crypto policies have to deal with - issues that in fact have to be resolved before governments can try to implement a crypto policy. I shall focus on law-enforcement perspective rather than on national security issues, as law enforcement is increasingly pushing towards regulating cryptography.

A brief note on terminology. The US government and its opponents have honoured us with many terms for essentially the same thing: key escrow, government or judicial access to keys, key deposits, key recovery, and key management. Essentially, they all involve a scheme in which the government can, with a court warrant, get access to cryptographic keys. I shall use these terms interchangeably.

II. A Brief Survey of Europe⁽¹⁾

II.A. Export Issues

II.B. Domestic Controls

Other attempts to control cryptography have taken place in various countries. Belgium adopted a law in late 1994 which was noticed only in 1996 to contain a provision that might be interpreted as a prohibition of using cryptography in telecommunications [14]. If you use 'equipment which renders tapping ineffective', your telecommunications equipment might be seized, according to the provision. Some have seen this as a requirement to use escrowed encryption (that is, depositing your key with an agent so that law enforcement can access it if they have a judicial warrant). One member of parliament has proposed dropping the provision and instead requiring people to decrypt if this is necessary for the investigation.

Although Germany has so far done nothing, rumours abound that a crypto law is imminent. On the other hand, these rumours have been going on for at least two years, and it may be that the government is too divided over the issue to be able to decide upon a form of regulation. Several politicians have argued in favour of restricting crypto use, whereas others have declared such initiatives useless. A similar situation exists in the Netherlands, where in early 1994, a pre-draft law to prohibit cryptography was hastily withdrawn after huge public outcry. Since then, the government has been studying the issue; it seems that the Dutch government will focus on self-regulation of voluntary key-escrow or key-recovery with Trusted Third Parties (TTPs). Another Dutch policy line is requiring people to decrypt: presently, the police can command anyone (provided he is not suspected of criminal activities) to decrypt stored information during a search; the government wants to extend this possibility to encrypted telecommunications. Both commands have limited value in practice: most often, only suspects will know how to decrypt, and they are not required to incriminate themselves, and as for telecommunications, it is hard to decrypt because most often session keys are discarded immediately after the conversation.

Finally, the United Kingdom is currently leaning towards mandatory depositing of keys with TTPs. In a policy 'Paper on regulatory intent concerning use of encryption on public networks' of June 1996, they announced this initiative [5]. Licensed TTPs would be required to release to the authorities the private encryption keys of clients under similar safeguards to those which already exist. The licensing policy would aim to preserve law-enforcement access, and so willingness to cooperate with law enforcement would likely be a requirement for TTPs to be licensed. The policy paper states that the government does not intend to regulate the private use of encryption (but rather corporate use), but this was contradicted at a meeting in June discussing the policy. The Department of Trade and Industry (DTI) confirmed at the meeting that escrowing of confidentiality keys would be mandatory. Fortune 500 companies, however, would be trusted to manage their own keys, because their concerns are supposed to be too high to risk not cooperating with law enforcement anyway. Prior to legislation, a consultation process with all interested parties would be held, as the government said to recognize the importance of broad acceptance of the business community. I am not sure to what extent this policy is being put into practice, but I tend to assume that the initial optimism exuded by the paper has been somewhat subdued by the public reactions.

A bit lonely standing out in Europe are the Scandinavian countries, which tend to be more on the privacy-side. Especially Finland and Norway have more or less spoken out against the use of key deposits. The Danish IT Security Council recommended that no limitations on encryption use should be introduced, and it was of the opinion that secure and inviolable communication should be promoted [3].

Outside Europe, especially the US and Japan are important. The situation in the United States is well-known, so I can be short on that. US export controls are severe, with a maximum of 40-bit symmetric crypto being exportable, or 56-bit crypto if the manufacturer commits to building in government access to keys within two years. The transfer of export controls to the Department of Commerce in late 1996 has not brought a relaxation, despite a recommendation of the National Research Council to gradually relax export controls [10]. As to domestic crypto use, ever since the Clipper chip, the US government has worked on schemes that allow law-enforcement and national security officials access to plaintext or keys, that latest of the proposals being a Key Management Infrastructure, with Certification Authorities and Escrow Authorities. The 'Broad Encryption Policy' announced in October 1996 did not bring anything really new. It stated that domestic use of key-escrow cryptography will be voluntary, and the choice of an encryption system will remain free. The government will, however, promote key-escrow cryptography by expanding the purchase of key-escrow products for itself, promoting key-escrow cryptography in international discussions, and stimulating the development of innovative key-escrow products and services. Several enterprises have taken up the challenge of building key recovery systems. Japanis more complicated. In the OECD meetings, Japan initially mainly stressed the economic importance of strong cryptography, but gradually, they seem to have shifted towards the law-enforcement perspective. It seems their stance is yet unresolved [cf. 1].

This brings me to the OECD. After a year of debates and negotiations, the Council of the OECD will adopt guidelines for crypto policy in April 1997 [11].⁽²⁾ It seems especially the US have strongly lobbied for their key recovery policy, while some other countries have tried to stress the privacy perspective. The fight over both perspectives shows in the final result. In fact, although the guidelines pretend to give guidance to countries to implement national crypto policies, the guidelines do not guide at all. They stress the protective and privacy-related principles as well as the government access principle, and all principles should be seen as interdependent. The problem is, of course, that some sort of trade-off has to be made, and the guidelines sadly fail to indicate the direction this trade-off should be looked for. In effect, the OECD guidelines serve as a sample menu for states to pick and choose from, rather than as a guiding framework. The last revisions of the guidelines underline this. The principle of international cooperation was initially worded that governments should harmonise crypto policies; in the final version, governments need only coordinate policies, which leaves more room for national interpretation and variance. It is also significant that some protecting principles were ultimately weakened, the major revision being the principle of free choice. Where the earlier versions read that crypto users should have a right to choose any crypto method, this was extended with the restriction 'subject to applicable law', thus setting open the door for a prohibition of cryptography. In fact, the guidelines contain a statement that key-management systems could provide a basis for a possible solution to balance the privacy and law-enforcement interests. I suspect 'key management' to be a euphemism for key deposits.

III. Key Trends

Along with the increasing concern for cryptocriminals, the awareness of the nature of the dilemma is growing. Most prominently emerging from the OECD discussions, governments realise more and more that there is no easy answer to solve the problem. Some are tentatively launching pilots, or consider marginal solutions, but most countries seem to be waiting. One would expect them to have waited for the OECD guidelines and then initiate policy measures, but it is doubtful whether many governments will now move and establish crypto laws when there is no clear guidance by the OECD. After all, they will have to resolve the balance between privacy and law-enforcement for themselves, and this is a herculean task. So, while the concern for law-enforcement (and national security) being threatened by criminal crypto use has risen, this has not yet led to serious or realistic steps to resolve the issue.

However, you will retort, what about all these key-escrow, TTP and key recovery initiatives? Indeed, these are a third trend. TTPs are all the rage, and it may rightly be called a key trend. Many have the idea that somehow, access to keys must be safeguarded if the police is to continue to wiretap at all. The Clipper chip and its successors and the mention of 'key management' systems in the OECD guidelines show the push of governments wanting to implement this. Also, the European Commission has been working on a European Trusted Services (ETS) system, which would somehow involve key deposits. However, it is significant that nothing has come out of it so far. Clipper and the subsequent trials for government access to keys have all been renounced by the US public - so far. I am suspecting that the ETS proposal has died somewhere in the offices of the European Commission. And the OECD guidelines leave 'key management' as an option, but do not give an impetus for implementing it.

It is true that many are working on cryptographic proposals that incorporate key recovery [see for an overview: 4, 13]. Indeed, one can distinguish two main lines of proposals. The first is exemplified by the Royal Holloway scheme [7], which creates a system with key deposits at national key deposit centres, in such a way that even with international communications, the police need only go to its national key centre to access the session key. The Royal Holloway scheme relies on key deposits, and it is rather rigid in its implementation. I do not know whether it has been tested in practice at any scale. The second line has as its major proponent TIS (Trusted Information Systems) with its RecoverKey International [2]. This scheme does not require prior key deposits, but instead provides government access to keys by requiring users to send along the session key in a separate package tagged along to the message, so that a Data Recovery Centre can access the session key and hand it over to the police if they have a warrant.

Does this trend mean that TTPs and key recovery are the major direction for future crypto policies? Not necessarily. Considerable obstacles have to be overcome, which I shall go into presently. I tend to believe that key recovery proposals will not be effective, and if you allow me to make a bold prediction: I guess that key recovery systems will not be implemented on a large scale, and that no government will dare to make them mandatory. Perhaps I am wrong, and in ten years' time, key recovery encryption will be built-in in all operating systems, network protocols, browsers and mail programs. But even then, the law-enforcement problem will not have been solved, simply because cryptocriminals will always find ways to encrypt outside of the government-mandated systems.

Which brings me to the fourth trend. Not only the key recovery lobby has come front-stage. Privacy advocates are also increasingly making themselves heard. And computer security has become one of the major issues of the information society. This means that governments who intend to regulate cryptography face a fierce opponent. Notably in the US, many lobby groups advocate crypto liberalism, but one can see 'electronic frontier' groups arising everywhere. And more so, even if they have been a bit slow, even governments increasingly realise the threats to privacy and information security in the information age, and they stimulate data protection and information security measures. In my estimate, the rise of the privacy lobby in the public as well as in governments themselves means that the lobby for restricting crypto is more or less balanced by the lobby to stimulate crypto use. Of course, the balance differs somewhat per country, depending on its culture and its experience with automation and crime, but overall, I think the balance in lobbies is one of the reasons why few countries have developed a crypto policy yet.

IV. Key Issues

The first issue concerns the aim of a crypto policy. In fact, there are two major potential aims for crypto policies, and they have difficulty living together. First, a crypto policy can be directed at providing people with a robust, reliable crypto system. To prevent crooks from using it to thwart wiretapping, one may build in options which discourage or prevent abuse - key recovery may do just that. One should realise that in this case, the crypto policy is still targeted at law-abiding citizens; criminals will simply use other means of cryptography (if the fraud prevention works sufficiently). The point here is that many users in the information society need good crypto, and governments have a responsibility to make sure they can have it.

Second, a crypto policy can be aimed at solving the problem law enforcement has with cryptography. In this case, the policy must be targeted at criminals, and its effect must be that the law-enforcement problems are solved to a considerable extent. I hope you see the fundamental difference between the two. The direction of solutions may perhaps coincide, but their impact differs considerably. Look at the various American proposals: their language often implies that they are aimed at giving law-abiding citizens reliable, robust cryptography (which discourages criminal abuse by building in key recovery) - this is the first aim. The public, though, has generally interpreted the proposals in the second way: as being aimed at catching criminals, which, naturally, the proposals fail to do, because they are not meant to catch criminals per se, but rather provide a robust crypto system for those who want it. I think that many of the heated discussions in the crypto debate stem from a failure to distinguish sufficiently between the two aims. One must criticise a security solution with arguments why it fails to give people robust encryption, and one must criticise proposals to solve the law-enforcement problem with arguments why they would not work with criminals. People so far are mixing up all arguments, and this has not particularly clarified the discussions.

The second issue I want to raise is international cooperation. Although most governments recognise that crypto policies cannot be implemented on a purely national basis, the international discussions, especially within the EU and the OECD, indicate that it is difficult indeed to establish cooperation between states that differ so much as the US and Denmark, or even as UK and France, or even as the Netherlands and Belgium. Crime and investigation are rooted in national cultures, and law enforcement and national security are notable fields where states fiercely protect their sovereign rights. The OECD guidelines show it throughout: international cooperation in crypto policy is a virtual impossibility, at least for the time being. States will therefore decide for themselves which kind of crypto policy to choose. They will look abroad, perhaps, for guidance, or for some cooperation, but essentially, it will be the national situation that will steer the decision, not the international situation.

This will have implications for the solution chosen. For instance, key recovery depends on access to keys, and for this to work on any scale, international access to keys must be safeguarded somehow. Suppose that the US, UK, France and Russia will implement key recovery systems: how will they handle communications with the rest of the world? I do not think they will have enough economic power to force these systems on countries who do not consider key recovery out of their own accord. Similarly problematic: how will they handle communications among themselves? Will France rely on cooperation with the FBI to access keys? Will the FBI rely on Russia's FAPSI (the successor of the KGB) to give them keys? I think not. I think all states will be reluctant to give foreign states access to the keys of their companies, because they are much too afraid (and with reason, I dare say) of economic espionage. I consider this a major reason why the Royal-Holloway scheme will not work, and why the successors of the Clipper chip will never be exported from the US on a large scale. If key recovery does not work internationally, states may still consider it for their domestic policy, and disregard international communications. Given the aim of preventing criminal abuse, though, such a system will hardly have any effect on criminal organisations, which function on a mainly international level, and therefore, one can question the cost-benefit ratio of such a solution.

The international component is one of the difficulties of key recovery. Since key recovery is presently so popular, I feel it incumbent to take key recovery as my third issue. It raises many concerns, several of which feature in the OECD guidelines. I have already mentioned two of them: is key recovery aimed at providing law-abiding citizens with a reliable crypto system, or is it aimed at catching criminals? And how do you envision international access to keys? I want to raise four other points. The first relates to the OECD principle of trust. Key recovery schemes have been proposed only since 1993, and consequently, have not been researched to the extent that traditional systems as RSA or DES have. It is a primary cryptographic principle that the strength of a system can not be proven theoretically, but has to be proven in practice, by long years of attacks by cryptanalysts. Key recovery systems have yet to be subjected to thorough examinations by the cryptographic community. For this reason, trust in key recovery schemes will have to be low for some time to come.

A second obstacle to key recovery is liability. Agencies that provide law enforcement with access to keys, either through key deposits or through sent-along session keys, will be a target for attacks, and loss of keys may have huge financial consequences. Therefore, it is to be expected that key recovery agencies will want to exonerate themselves from liability, at least to a large extent. Will users accept this? I feel that many will prefer keeping their keys to themselves if they are liable anyway. By definition, a Trusted Third Party is supposed to encourage trust, and exoneration of liability does not seem to be a particularly trustworthy feature. If key recovery agencies will then have to accept liability for losses caused by leaking of keys, they will have to insure themselves. I think they may have difficulty here, because the risk is unpredictable - confidentiality keys protect a whole range of information, from economic and financial data to privacy-sensitive information. But how do you assess loss of privacy? In short, liability must be addressed, but it will be a thorny issue.

The third issue in key recovery is constitutional rights. At stake is the right to privacy, including the right to confidential communication, a right established by human rights covenants and many constitutions. If states implement key recovery, they must see to it that this constitutional right is not hampered. Although potentially, key recovery is compatible with the right to privacy, when you start implementing key recovery, you will have to address the extra risk such a system poses to privacy - after all, key recovery systems are inherently weaker than non-recovery systems.

A fourth problem is the question who will be the recovery agent. The Clipper controversy has shown that, in the US, government bodies are not the most logical choice for Trusted Third Parties. But if users do not trust their governments, who will they trust? Obviously, they will pick and choose private bodies. But then again, governments will not trust all private bodies. Some sort of middle way will have to be found, and I think this will be a major challenge. I mention these issues, trust, liability, privacy, and who will be TTP, to show that key recovery is tricky - I think you can call it a minefield. It is an interesting field which merits study, but states must realise that if they implement it, the policy may explode somewhere along the road.

V. Framework

Before governments can cut this knot, they will have to analyse the problem they want to solve. This seems more self-explanatory than it is. The confusion between the different possible aims of a crypto policy indicates that many states are not yet really aware just what problem they are trying to solve. In my opinion, if states want to solve the law enforcement problem of crypto criminals, they will have to deeply analyse just which criminals are currently using crypto or will do so in the near future, how the investigation of these kinds of crimes takes place, what law-enforcement measures are necessary to investigate these crimes, and how these measures are hampered by cryptography. Only with an indication of the extent of the problem can one decide whether it is time to take far-reaching measures. My estimate is that currently, the problem is not too bad for law-enforcement, although this may be different in a few years' time.

After this analysis of the problem, one must look at the alternatives. So far, key recovery has received by far the most attention, and this has been an unwelcome inclination. The minefield of key recovery is worth studying, but it can not be the only option. Indeed, ultimately, key recovery can never solve the crypto problems for law enforcement, although it may help in reducing it. Other alternatives must therefore be studied. The first is requiring people to assist in decryption, or to hand over keys. The survey shows that some countries already have such a possibility, although the command may not be given to suspects. The principle that people are not required to incriminate themselves is a constitutional principle (laid down in the International Covenant on Civil and Political Rights). However, given the far-reaching implications of any solution, it may be worth while to study the possibility of setting aside the right to non-selfincrimination and to require suspects, if there is sufficient probable cause, to hand over a decryption key. Whether this can be at all considered depends on the national culture of criminal investigation and the level of constitutional protection. Even so, it may turn out that both key recovery and requiring suspects to decrypt will not serve to solve the crypto problem for law enforcement. Perhaps, then, we must look for other investigation measures. In the Netherlands, a major political discussion is taking place on investigation measures, and soon, several more or less controversial issues will be decided upon, such as using directional microphones to listen in on people directly, accepting crown witnesses, and undercover agents. Perhaps data mining can assist the police in tracking criminal organizations. Such investigation measures merit study, and it could turn out that there are sufficient other ways than wiretapping to catch criminals.

I have no idea yet what is the best way to look. To choose between the various alternatives, one must first define criteria for judging them. The OECD guidelines may serve as a first step in defining such criteria. Every state can extend it with national priorities, and thus create a good framework for deciding upon a solution to the crypto problem. They will have to take into account the entire context, of crypto-criminals and how they function, and of the information society and its need for information security. Only a clear definition and an integrated analysis of the problem, the alternatives and the criteria involved can solve the crypto problem - if it is to be solved at all. That will be for governments to decide.

VI. References

[2] http://www.tis.com/docs/products/recoverkey/index.html

[3] Danish IT Security Council, 'The right to encryption', press release, 11 June 1996.

[4] Dorothy E. Denning, Descriptions of Key Escrow Systems, http://www.cosc.georgetown.edu/~denning/crypto/Appendix.html.

[5] Department of Trade and Industry, Paper on regulatory intent concerning use of encryption on public networks, 10 June 1996.

[6] EU Council Regulation (EC) No. 3381/94 and EU Council Decision No. 94/942/PESC, Official Journal No. L367, 31 December 1994.

[7] N. Jefferies, C. Mitchell, M. Walker (Royal Holloway, University of London), 'A Proposed Architecture for Trusted Third Party Services', in: Cryptography: Policy and Algorithms - Proceedings: International Conference, Brisbane, Australia, July 1995. Springer-Verlag LNCS 1029, 1996, pp.98-104.

[8] B.J. Koops, Crypto Law Survey, http://cwis.kub.nl/~frw/people/koops/lawsurvy.htm.

[9] Loi Numéro 90-1170 of 29 December 1990, Journal Officiel, 30 December 1990; Décret Numéro 92-1358 of 28 December 1992, Journal Officiel, 30 December 1992, and Loi de réglementation des télécommunications of 18 June 1996, amending art. 28 of Loi Numéro 90-1170 of 29 December 1990.

[10] National Research Council, Kenneth Dam, Herbert Lin (eds.), Cryptography's Role in Securing the Information Society(Prepublication copy), Washington, D.C.: National Academy Press, 30 May 1996.

[11] OECD, Recommendation of the Council Concerning Guidelines for Cryptography Policy, Draft, December 1996.

[12] Ukaz Prezidenta Rossiyskoy Federatsii ot 3 Aprelya 1995 goda, No. 334, o merakh po soblyudeniyu zakonnosti v oblasti razrabotki proizvodstva, realizatsii i ekspluatatsii shifroval'nykh sredstv, a takzhe predostavleniya uslug v oblasti shifrovaniya informatsii, Rossiyskaya Gazeta 68, April 6, 1995.

[13] E. Verheul, B.J. Koops, H. van Tilborg, 'Binding cryptography - a fraud-detectible alternative to key-escrow proposals', Computer Law & Security Report, January-February 1997, pp. 3-14

[14] Wet betreffende de hervormingen van sommige economische overheidsbedrijven of 21 March 1991 (art. 70bis and 95) and of 21 December 1994 (art. 202 and 203).

Author Information

E-mail: E.J.Koops@kub.nl

WWW: http://cwis.kub.nl/~frw/people/koops/ bertjaap.htm

Notes

2. I base my description on a December 1996 draft of the guidelines, which were approved by the OECD Group of Experts on Security. Privacy, and Intellectual Property Protection in the GII. I expect the Council of the OECD will not significantly change the guidelines as they appear in the draft. (Back to text.)