RIPA doesn't require the key to every single message.

It's much like a search warrant. If requested by the police, you are required to suddender either the key or a plaintext version of the message in question. This cannot just be requested, but must be at the order of (IIRC) the Home Secretary, a Judge or a Chief Constable.

IE random mailing of messages to people won't do anything, since it's highly unlikely the police would ever demand such keys.

This point was already made with hundreds (thousands?) of people emailing Jack Straw (the Home Secretary at the time RIPA was initially announced) PGP-encrypted email to which he, obviously, did not know the key... but, unless his key is actually requested, he is not breaking any laws.

Oh, and "forgetting" your key/password/whatever is not a defence.

-G-

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/95/14382#14382