UK Government to Force Handover of Encyption Keys

[Apophis]

"Businesses and individuals may soon have to release their encryption keys to the police or face imprisonment, when Part 3 of the RIP Act comes into effect

The UK Government is preparing to give the police the authority to force organisations and individuals to disclose encryption keys, a move which has outraged some security and civil rights experts."

Full article here.

This disturbs me quite a bit. More credit cards and consumer identifyable information has been stolen from government and industry than from private individuals. With the UK government forcing disclosure of private keys, I think there should be great concern over their method of securing them and guaranteeing their safety.

[RandomGuy]

I wonder how many Britons will lose their jobs because of this?

Nevermind the fundamental freedoms at stake.

[Apophis]

Originally Posted by RandomGuy

I wonder how many Britons will lose their jobs because of this?

Nevermind the fundamental freedoms at stake.

I'm not sure how things like ATM machines work in the UK, but here in the US there are specific organizations that neither have access into the physical hardware, software or bank accounts associated with the ATM machines. These organizations seed the ATM machines with the appropriate encryption keys to talk back to the banks and processors that own them. If these organizations were also required to provide private keys to the UK government, and those keys were compromised in bulk, holy hell could break loose in the financial industry.

I'm not sure what level of security the government would apply to the protection of those keys, but having tested the security of companies in this industry, I can tell you that most of the companies that manage this sort of thing take security VERY seriously.

[DudeMan]

the report seems to be blowing it out of proportion on my opinion, the power will not result in a nazi styledoor to door collection of encryption keys. the law only allows the police, by law to get the encryption keys in their line of investigation.

i actually aprove of this, the fact is, fear of corrupt contstables is well fantasicised, something from the flicks. the police and the home office will hold all the information contained on our ID cards anyway. the law is designed to give the police greater powers, not to allow draconian use of the powers to make somekind of hollywood style grab for bankers cash....

[GhostintheShell]

Are they really interested in the keys, or in a second backdoor decryption key for themselves.

For instance, one of the encryptions I use has a "duress" password, where you enter the real key with a certain prefix you select, and it will permanently scramble the real data and open a second seemingly authentic data set (again that you select) in case of emergencies.

I can't see them being interested in the key used to encrypt, so much as a backdoor.