U.K. Faces Protest Over E-Commerce Bill

Welcome Guest. | Log In| Register | Membership Benefits

July 26, 1999 (10:07 AM EDT)

By Madeleine Acey,

The British government has published its controversial Electronic Communications Bill to a storm of protest -- but its introduction is too late to pass the legislation in the current session of Parliament.

The draft legislation calls for two-year prison sentences for people who fail to provide keys to encrypted data -- or plain text -- when demanded by law enforcement. If an ISP "tips off" a user involved in an investigation, the ISP would face a five-year jail term.

Civil-liberties groups said the bill was almost as bad as the original proposals that sought to demand escrowing of Internet users' encryption keys with government-approved third parties to provide law-enforcement agencies with access to all communications.

The bill also sets out a framework for secondary legislation that one group said could see key escrow brought into law by the back door.

These ministerial powers could compel key escrow as a condition for approval as a "Registered Cryptography Service Provider," said Caspar Bowden, director of the Foundation for Information Policy Research.

"Although some of the more objectionable aspects of previous proposals have been dropped from primary legislation, the bill gives ministers the power to introduce them later as regulations," Bowden said.

"The government is taking powers which could discriminate in favor of signatures certified by organizations joining their approval scheme. When frauds start happening, the customer will be blamed," he said.

"There are many issues here, including the right to silence as the individual has to prove that he does not have the encryption key and is innocent," said Peter Noorlander, legal policy officer of the lawyers' human rights group Justice. "We don't know at this stage whether this violates the European Convention of Human Rights, but we are getting the opinion on whether it does."

The authorities should have to present a judge with reliable evidence the data in question actually contains an encrypted message, Bowen said, and the person being served with a disclosure notice actually possesses the key.

It also must be proved the data contains evidence of or would assist in pursuit or detection of a serious criminal offense.

The bill would not improve the UK's standing in global e-commerce as it intended, Bowen said, but would move businesses to countries like Canada and Ireland that are free of red tape.

A Department of Trade and Industry spokesman said the timing of the bill allowed for further public consultation until Oct. 8 and it would be introduced for Parliamentary debate in early November.

Network Week's Laura Berrill contributed to this report.