What bodies of laws protect against the disclosure of private encryption keys?

Question

I am interested in US law as well as European law, and curious about international/other countries law, if applicable.

It is generally accepted that if you somehow find a private key (let's assume by reverse-engineering for now), you can't publish it. For example, this question takes it as a given.

However, I don't see what exactly in the law prevents from doing so. If you are given a piece of hardware or software that contains the key, it actually seems to me that there is nothing to prevent the key from being redistributed?

As far as I know copyright requires the material to be a creative work, with some originality. While the originality could be argued, I am not sure the creative work part would held. Moreover, it is well established that facts are not copyrightable. Can't a key be considered a fact?

The key can certainly not be patented, but it can be considered a trade secret. As this trade secret was not acquired trough unlawful means (such as an NDA breach), couldn't it be disclosed?

I am interested in legal precedents on the matter as well, if you know of any.

Answer 1

You shouldn't redistribute the key if you know a person will use it to crack the software.

These are a few subsections from the law in the UK.

This section applies where— (a)effective technological measures have been applied to a copyright work other than a computer program; and (b)a person (B) does anything which circumvents those measures knowing, or with reasonable grounds to know, that he is pursuing that objective. (2)This section does not apply where a person, for the purposes of research into cryptography, does anything which circumvents effective technological measures unless in so doing, or in issuing information derived from that research, he affects prejudicially the rights of the copyright owner.

From Section 296ZA of the Copyright, Designs and Patents Act 1988 (http://www.legislation.gov.uk/ukpga/1988/48/section/296ZA)

There will definitely be something like this forbidding circumvention of measures to the US as well.

There might be some EU legislation that has stuff about cryptography. That will probably be your last resort if you can't find much else.

If you're using this private key and redistributing it for criminal intent, well then. This might be another problem. You may be allowing others to intercept the data in what the key is used for. Regulation of Investigatory Powers Act 2000 might be relevant for you.

Answer 2

I know of no law that bans disclosure of private encryption keys.

This news article: Lawsuit Dropped Against DVD Copy-Protection Hack deals with acquittals both in Europa (Norway) and the USA in high profile cases where people were charged with distributing such keys.

(I most jurisdictions, using such keys to gain unlawful access to secret or copyrighted materials, is illegal - but that is something else.)