The middle of last month saw the publication of the Trade and Industries Committee's Report on proposals relating to electronic commerce.
The Internet has become the fastest growing market place in the world economy and therefore the correct legal structure needs to be in place. Many commentators have said that the Electronic Commerce Bill provides an opportunity to build confidence and trust in the UK as a centre for e-commerce. The Committee, with the backing of commentators, has suggested that a permissive approach be used if the practice of e-commerce in this country is to be encouraged. Trust is central to the objectives of strong demand from knowledgable users, a strong supply sector and the right legal regulatory and institutional framework. However, the Committee stated that the Government's proposal to facilitate trust in electronic commerce must not interfere with existing, and often long-standing, electronic commerce relationships.
The Report is highly critical of the Government in terms of its proposals and of the timescale in which it has taken to investigate those proposals. One of the key criticisms relates to the Government's proposal for key escrow.
Originally the Government had insisted that the key to codes must be held ("key escrow") by "trusted third parties" (TTPs) to facilitate giving access to the police and intelligence services provided they had a warrant. This proposal has been criticised widely, especially as France and America had decided to drop similar proposals due to the inhibition it would have on the growth of e-commerce in those countries. Indeed, the Committee stated that
"the issue of law enforcement access to cryptographic keys, particularly to facilitate covert, real-time interception of data communications, has been central to the debate about electronic commerce policy."
Adverse comment from industry also relates to the technical difficulties related with key escrow and the cost of developing those facilities (particularly since no-one had ever done it before so how to do it clearly imposed problems and this whole area of uncertainty was actually holding back public key infrastructure projects). Additionally, there was a likelihood that private key storage facilities would become criminal targets and there were also concerns about privacy and civil liberties.
Another of the major criticisms of the Committee is the length of time, it would seem without any legitimate reason, that it has taken the Government to establish and implement a cryptography policy. Although a minister said that "It is a very fast moving world... technology is changing all the time", the Report states
"the rate at which the Department of Trade and Industry has moved in this area, has been glacial".
British industry made it clear in mid 1997 that it did not hold the key escrow concept in high regard but it has taken until March 1999 before the Government half heartedly accepted this view. This delay, warns the Institute for the Management of Information Systems, may have caused a severe barrier to UK competitiveness, as the law in the UK has failed to keep pace with the growth of electronic commerce.
Commentators also warned that a mandatory or voluntary key escrow system would have a detrimental impact on the competitiveness of the UK economy. If key escrow was introduced into the frame, UK business would look to TTPs abroad.
The Committee's final comments on key escrow was:
"By dropping key escrow as a licensing condition for TTPs the DTI's third attempt to formulate an acceptable cryptography policy is a marked improvement on its predecessors. We are disappointed, however, that the Government should still hold a candle for key escrow and key recovery".
"We can foresee no benefits arising from the Government promotion of key escrow or key recovery technologies."
It may seem now that the Government has finally turned the corner on key escrow and wishes to implement legislation to encourage development of electronic commerce in this country rather than control cryptography. The cynic might even ask why on earth, having delayed so long, that the Government does not await the adoption of the EU directives in this and related fields and then pass a law which it knows will implement the directive accurately. Also, recent official statements have indicated that the upcoming Electronic Commerce Bill will only now deal with "housekeeping" matters. Why not wait, then, and deal with implementation of the EU directives on electronic commerce and electronic signatures at the same time?
Publication of the Electronic Commerce Bill in the next few weeks will hopefully confirm key escrow is dead.
Heather Rowe, Partner and Andy Dale, Trainee Solicitor