Government able to demand keys to encrypted data

By MICHAEL FOREMAN

An obscure clause in the Crimes Amendment Bill could be used to force computer system owners to hand over the keys to encrypted data, says an Auckland security expert.

Clause 19 of the Supplementary Order Paper 85 exempts Security Intelligence Service personnel with interception warrants from prosecution under the proposed crime of unauthorised access to a computer. This clause also exempts "a person, or member of a class of persons, requested to give any assistance that is specified in that warrant."

Lech Janczewski, an Auckland University lecturer in management science and information systems and chairman of the New Zealand Information Security Forum, says the phrase "any assistance" could include handing over decryption keys.

"It's not very explicitly written but in my opinion it is the most controversial aspect."

Access to decryption keys would allow Government agencies to read encrypted data without requiring expensive technology that would break codes using time-consuming algorithms.

Mr Janczewski, who was speaking at a seminar held by the Information Security Forum last week to debate the Government's proposed electronic snooping laws, was one of several speakers who complained that the text of the proposed legislation had been difficult to obtain.

"What I believe is wrong at this stage is not really the content of those documents but the way it has been presented. If a document of that importance is kept under such wraps I believe something is not right."

Mr Janczewski said the Supplementary Order Paper was almost unintelligible as it referred to many other acts, and it was almost impossible to make sense of the proposed legislation unless you also had access to the text of those acts.

While the text of the legislation is available in printed form from Bennetts Bookshop, the Internet Society of New Zealand has compiled an online version including hyperlinks to relevant other acts at http://www.isocnz.org.nz/issues.html.

Craig Horrocks, a partner at Auckland law firm Clendon Feeney, said the Supplementary Order Paper had "caught the legal profession by surprise.

"There hasn't been a move by Government to tell us about this and the document is exceedingly difficult to find."

Mr Horrocks said he was annoyed that the Government had mixed controversial surveillance proposals with urgently required legislation to combat hacking and other electronic crimes.

In a separate development, Green Party MP Keith Locke said the Government's February 9 deadline for submissions on the Crimes Amendment Bill (No. 6) should be extended.

"This deadline betrays a commitment Communications Minister Paul Swain made when introducing the bill, that there would be about six months for people to have their say," he said.

"If you take away the holiday period, a February 9 deadline gives people very little time to prepare their submissions.

"Electronic interception and hacking are highly technical areas. Fully informed submissions will take some time to prepare. There are also major human rights and privacy issues for submitters to wrestle with."