4

Is it legal to send encrypted messages (specifically using RSA key-pairs and AES 256) online in Canada and the USA?

Also, can law enforcement request it to be decrypted without probable cause?


PS. The messages being sent are generally not confidential (eg. chat messages). This is a measure so that if a confidential message is sent, it would be between a mass of non-confidential messages (therefore harder to find the confidential messages, if any).

This may also extend as a second layer of security (eg. if an unauthorized user has gained access to one of my accounts, they would not be able to read the messages sent / received)

Improve this question
9
  • 1
    The "decrypted without probable cause" for the United States may be answered here -- in short, they (probably) can't get it decrypted even with probable cause.
    – Mark
    Commented Nov 4, 2015 at 6:44
  • 1
    The answer to this has to be yes, since literally tens or hundreds of millions of North Americans do it everyday in the form of https, which uses asymmetrical key pair encryption via TLS. Without this, internet commerce would be impossible. In the US, I believe there are provisions for law enforcement to demand logs from ISPs without a warrant, but there would not be any message content included with that, nor is it possible to violate the encryption this way by eavesdropping.
    – goldilocks
    Commented Nov 5, 2015 at 8:35
  • Yes, I understand how HTTPS works, but I have heard some countries do not allow the use of cryptography in any way, shape or form (and that some countries limit the maximum number of bits for a symmetrical key) --- Although I have not confirmed this...
    – J C
    Commented Nov 5, 2015 at 14:59
  • Also, thanks for providing me with further assurance that my initial assumption was correct
    – J C
    Commented Nov 5, 2015 at 14:59
  • 1
    @delicate Yes practical schemes like HTTPS use a combination of asymmetric and symmetric cryptography. But there is still a distinction: the original 'RSA-only' key-exchange in SSL and TLS does use RSA encryption to generate the actual encryption keys; the slightly newer DHE and ECDHE key exchanges use DHE or ECDHE for key agreement to generate the encryption keys and RSA (or possibly but rarely DSS or ECDSA) for authentication. (There are also other options not used in practice on the public web.)
    – dave_thompson_085
    Commented Dec 11, 2015 at 5:35

2 Answers 2

Reset to default
1

Summary

  • Encryption legality: Sending encrypted messages is legal, but exporting advanced cryptographic technology is regulated
  • American law enforcement: Probably cannot obtain decrypted data due to the Fifth Amendment, though it's an open question
  • Canadian law enforcement: Can obtain decrypted data given reasonable grounds and when you are not under investigation (i.e. it's for the purpose of investigating someone else)

Legality of Encryption

As pointed out in the comments, encryption is used daily by many in North America. This happens when browsing the internet, using Skype, electronic banking, etc. In Western countries at least, sending encrypted messages is generally legal.

What is regulated, however, is the export of the crypto-technology itself. This is handled through the Wassenaar Arrangement, an arrangement between 40+ countries, of which Canada and the US are a part. The arrangement deals with the exports of conventional arms and dual-use technologies, including cryptographic technologies. The relevant portion is Control List 5, part 2. It contains an exception in Note 3, essentially stating that widely available cryptographic technologies are left uncontrolled.

American Law Enforcement

As pointed out in the comments, the American perspective has already been addressed on this site. Briefly summarizing Mark's and cpast's answers there:

While the issue has not yet reached the Supreme Court, it appears requesting decrypted data violates the Fifth Amendment. There may be an exception though, when the document's general contents are already known.

Canadian Law Enforcement

In Canada, The general way to compel someone to give documents or data is through a Production Order defined in § 487.014 of the Criminal Code. There are a few types of production orders, but I'll cite the general one:

(1) Subject to [the more specific production orders], on ex parte application made by a peace officer or public officer, a justice or judge may order a person to produce a document that is a copy of a document that is in their possession or control when they receive the order, or to prepare and produce a document containing data that is in their possession or control at that time.

(2) Before making the order, the justice or judge must be satisfied [...] that there are reasonable grounds to believe that (a) an offence has been or will be committed under this or any other Act of Parliament; and (b) the document or data is in the person’s possession or control and will afford evidence respecting the commission of the offence.

There is no specific reference to decryption here, but I believe (1) implies it must be done: if you are able to decrypt a message, you are in possession/control of the data. However:

(4) A person who is under investigation for the offence referred to in subsection (2) may not be made subject to an order.

Because the suspect cannot be subject to the order, the main use case of production orders is to compel third parties to produce documents/data that would aid in prosecution of the suspect.

The third party is afforded some protection under § 487.0196. They cannot refuse the order on the basis of self-incrimination but if the compelled documents/data happen to incriminate the third party in some other offence, that evidence is not admissible against them (except for cases of perjury). Note that this is very similar to the provisions provided for in Charter sections 11(c) and 13.

Self Incrimination Note

Tangentially, this answer touched on a key difference in self-incrimination law between Canada and the US. In the US, you can plead the Fifth in any criminal proceeding. In Canada, you can only do so in your own, though what you reveal otherwise is not later admissible against you.

Improve this answer
8
  • I think you've got the "fifth amendment" bit upside down. Fifth amendment hits if the fact that you know the password is evidence against you. So if they know that you can decrypt the data, because you know the password, showing that you know the password is no (new) evidence against you.
    – gnasher729
    Commented Nov 6, 2015 at 22:12
  • Assume someone is killed by being hit with a laptop. The laptop is encrypted. The person decrypting the laptop is the killer; nobody cares what's actually stored - fifth amendment says you don't have to decrypt the laptop.
    – gnasher729
    Commented Nov 6, 2015 at 22:14
  • @gnasher729 Addressing your first comment: You might be right, I didn't do any independent research for that. However, my summary there doesn't include anything about keys/passwords, just the decrypted data, as asked in the question. I agree with you: showing that you know the password is no new evidence, but would decrypting and providing the data, where that data was previously unknown to law enforcement not violate the Fifth amendment?
    – DPenner1
    Commented Nov 6, 2015 at 23:45
  • Are you sure the following is correct? "Canadian law enforcement: Can obtain decrypted data given reasonable grounds and when you are not under investigation" --- Never mind, just read the last point at the very end
    – J C
    Commented Nov 7, 2015 at 0:32
  • How can someone have reasonable grounds and not be under investigation? Don't they contradict each other?
    – J C
    Commented Nov 7, 2015 at 0:37
-1

I think your question relates to whether it is lawful or not (vs legal). It is lawful to communicate in an encrypted fashion. Think of ATM banking, online purchasing, email, etc.

Improve this answer
1
  • What distinction do you draw between "lawful" and "legal"?
    – cpast
    Commented Nov 7, 2015 at 5:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .