Posted on 14/12/2012 on Oerlemansblog

In December 2010, the Robert M.-case shocked the Netherlands. Robert M. was prosecuted and convicted for the sexual abuse of 67 children, of which many were younger than 3 years old. During the investigation the police found that the suspect used high grade encryption, impossible to crack without using the proper key. Fortunately for the police and public prosecutor, Robert M. gave up his key voluntarily. Other suspects derived from the Robert M-case did not cooperate so well. This led Members of the Parliament to call for a so-called ‘decryption order’, by way of which suspects could be forced to give up their key. The Minister of Safety and Justice commissioned research into the feasibility of decryption orders in the light of the right against self incrimination. About two weeks ago the research was published and it concluded that theoretically it is possible to regulate the decryption order. As a result, the Minister of Safety and Justice enthusiastically announced (in Dutch) the preparation of new regulations to make decryption orders possible in cases of child pornography and terrorist crimes. However, in my opinion, we should think twice before going down this path.

The decryption order

Prof. Koops of Tilburg University conducted thorough and in my view excellent research (.pdf in Dutch) into decryption orders. Both the technical and legal aspects were taken into consideration and a legal comparison was made from many different countries. An English summary of the report can be found here (.pdf). The author suggests that a decryption order (under threat of a criminal sentence) is legally possible, but only under stringent conditions. For example, the order could only be given in cases in which there are clear indications that the suspect is hiding something by using encryption.

Proving that the suspect probably used encryption to hide his criminal activities may be difficult, especially when certain encryption programs such as ‘TrueCrypt’ are used. The report warns that decryption orders may advance the use of such programs among criminals. In Great Britain (obviously a much bigger country than the Netherlands), governmental power was successfully used in only a handful of cases per year. What I found even more interesting is that public prosecutors were very skeptical about the practical uses of this governmental power. They preferred obtaining the key using alternative methods, namely by intercepting keys remotely via the Internet. The author of the report does not deny that this is an interesting and feasible alternative route to take, but suggests that legislator should choose between the two. Instead, the Ministry of Safety and Justice suggests in his letter we should do both.

Note that the ‘solution’ of a decryption order is limited to accessing data stored on a device at a different phase of a criminal investigation. An important argument for using alternative methods, more concretely the use of hacking, spyware and bugs as investigatory methods, is that they also aid law enforcement in dealing with the growing problem of the encryption of communications (not just stored data) and avoids the active cooperation of suspects in their own criminal case.

The least privacy infringing solution for the encryption problem?

The decryption order is considered by some (including prof. Koops) as the least privacy intrusive solution for the encryption problem. I dare to disagree. The solution of a ‘decryption order’ may be more far-reaching than most people think. As suggested in the report, it should include disabling the security measures on all computer devices, such as laptops, tablet computers and smartphones. It also may be possible for the government to force civilians to hand over passwords to access online social media services, webmail services and personal online storage services.

Forcing civilians under a criminal sanction to actively help law enforcement by providing them with access to their own data is incredibly intrusive and would be new to the criminal law system. The fact it may be theoretically possible to regulate a decryption order under the threat of a criminal sanction does not mean that we should.