The UK's Investigatory Powers Act 2000 can force suspects to decrypt encrypted data or face two years in prison.

  1. What happens if an individual's private encryption key is managed by someone else across the world?
  2. Would this individual still be in legal trouble for being unable to decrypt the data?
  3. What if the third-party refuses to hand over the keys?
  • It is unclear why an individual would ever be responsible for a private key that is beyond his control or not known by him. – Iñaki Viggers Sep 16 '19 at 16:23
  • @IñakiViggers It's not uncommon, actually. In information security, this is called secret sharing, and there are algorithms designed precisely for this. I have done this when I visited a country where there was a very real possibility that I would be assaulted and robbed, which would include loss (disclosure) of extremely sensitive confidential information. To alleviate the risk, I shared the key using an algorithm called Shamir's Secret Sharing (SSS) with my partner and with an individual in my home country. I would be unable to hand over the key to anyone, be they muggers or law enforcement. – forest Sep 17 '19 at 8:15
  • @forest I'm aware of secret sharing and multisig schemes. Nonetheless, a person cannot be held [prosecutor's] hostage for an uncooperative third-party's fault. – Iñaki Viggers Sep 17 '19 at 10:26
  • @IñakiViggers Oh, it's possible that I misunderstood you. By "be responsible for a private key", did you mean this as in "responsible for managing" or "held responsible by the law"? I assumed the former. – forest Sep 18 '19 at 8:59
  • @forest Both, but with emphasis on the legal ramifications that a third party's non-responsiveness would entail. – Iñaki Viggers Sep 18 '19 at 22:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.