EU: OECD rejects US-UK-France plan
01 March 1997
The Organisation for Economic Cooperation and Development (OECD) of 29 nations meeting in Paris on 27 March rejected an initiative by the US backed by the UK and France to allow "law enforcement agencies" to tap into Internet communications. The proposal would have allowed the surveillance of encrypted (scrambled) e-mail messages and transactions by police, customs, and other agencies. An agreement on a "key-escrow system" would give law enforcement agencies the "keys" to break and unscrambled messages sent through encryption programmes.
Some of the OECD countries such as Australia, Canada, Denmark (see below) and Finland have laws to protect individual privacy which would not allow state agencies to hold the keys to break encrypted messages. While opinion in Germany is divided France already has in place a law which only authorises the use of encryption programmes to which the "keys" can be passed to law enforcement agencies.
One of the most restrictive proposal, on "Trusted Third Parties" (TTP's) is out for consultation in the UK. It proposes that to use an encryption programme which is not "officially licensed" would be a criminal offence and give police powers to raid and arrest anyone whose communications are indecipherable.
Denmark: Encryption report clashes with EU-FBI
The Danish government's expert committee on encryption, set up in 1996 and consisting representatives from government departments, issued a report in April. The remit of the committee is to deal with possibilities and problems concerning regulation by public authorities of the use of intermediate technology (IT) communications and encrypted messages. The report will be seen as containing recommendations for a "constitution" on Danish IT-policy said Mads Bryde Anderson, Chairman of the IT-Security Council.
The report claims that security measures have not kept pace with developments in communication in open networks, such as e-mail and the Internet. This deficit concerns protection against unauthorised tapping, security of the sender's identity and protection against changes in the message during communication. Encryption can in principle, the report claims, solve these problems. However, one problem they perceived with encryption was that the police, and other authorities, would not be able to break the secrecy in communication.
The committee tried to find a solution which would, on the one hand, promote encryption products and on the other, avoid the negative consequences of such products: that the authorities do not have access to such messages. It concluded that it is not, for the moment, possible to achieve regulation of encryption in Denmark. Neither a general ban against encryption nor regulation of the sale of encryption products would be possible. A ban would be impossible to enforce and criminals would simply find other ways of communicating, it said. Denmark's future policy has to be related to the encryption policy of its international partners. In coming months the Committee will consider voluntary solutions, where businesses and other organisations can deposit a key, in a so-called "key-escrow", that the police, with permission from a court, could have access to.
One reaction to the report came from the Commissioner of Police and Police Intelligence Service (PET) who said that he feared an escalation in serious crime and advocated tapping as an effective investigation measure.
EU countries have co-operated with the FBI in demanding that all network and service providers make their telecommunications tappable. The Danish committees recommendation takes a different direction, similar to one adopted by the Organisation of Economic Cooperation and Development (OECD). The OECD argues that the defence of data security outweighs the requirements of the police to investigate crime. Representatives of the Danish trade unions are strongly opposed to a law against encryption. The Danish government's standpoint