DTI fills in UK policy gaps

Nigel Hickson, head of security at the UK?s Department of Trade and Industry, savaged the US export restrictions on strong encryption this week, writes Nick Huber.

Hickson offered the clearest indication yet of the UK government?s policy on encryption, which incorporates access to private encryption and legal recognition for digital signatures.

Speaking at the International Commerce Exchange (ICX) conference in The Hague last week, Hickson dropped heavy hints about the UK?s upcoming policy, which has been a year in the making. It will include a voluntary licensing scheme for trusted third parties and key recovery agents; some legal access to private encryption keys; and no mandatory controls on the use of encryption within the UK.

Hickson also suggested there would be no compulsory key recovery for digital signatures or compulsory tie-up between certification providers and key recovery agents ? allowing separate vendors for the two services.

?It?s a nonsense when companies have to develop artificial engineering solely to get round farcical cryptographic regulations,? he said in an obvious reference to the beleaguered US government?s export ban on most forms of strong encryption.

In response to allegations of foot-dragging he conceded: ?Unfortunately, our careful review has taken a long time.? The policy announcement will come later this month, he said.

Senior ICL security consultant Chris Sundt attacked the idea of using trusted third parties, such as government agencies or banks, to guarantee the authenticity of electronic business and personal messages.

?Conflicting proposals for licensing schemes assume a simple model of trust ? either you?re trusted or you?re not. The real world doesn?t work like this,? he said.