0

Suppose I host some web app which stores information about its users. In the interest of confidentiality, that information is stored in an encrypted format. Under what circumstances could a legal authority require I decrypt it and give them access?

Furthermore, suppose that the web app doesn't actually do the encryption, it's encrypted client-side using keys provided by users before being sent server side for storage. Now it's not even possible for me to decrypt it, as I don't have the keys. What could a legal authority that wanted the data require me to do? I'm primarily interested in US law.

6
  • 9
    This question appears to be off-topic because it is requesting legal advice, which not only may vary from jurisdiction to jurisdiction but also from case to case, and so should be obtained from a qualified legal practitioner in the appropriate jurisdiction rather than from the Internet where the well-meaning and logical opinions you receive on the matter may leave you more ill-advised than if you hadn't asked at all.
    – Xander
    Jul 21 '15 at 22:46
  • Depending on the country, a legal authority still might jail you if you haven't convinced them you can't possibly comply.
    – cpast
    Jul 21 '15 at 23:27
  • 1
    This is definitely a question for law SE. Someone migrate it. Jul 22 '15 at 0:22
  • 1
    Also, it assumes that government intelligence agencies have ever cared about what they're legally allowed to do. Spoiler: They don't. Judge Dredd is a documentary... Jul 22 '15 at 0:29
  • Agree with migrate, I didn't even know there was a law SE site.
    – Jack
    Jul 22 '15 at 5:40
4

In light of the fact that you don't have the private keys (given the way that you've posed the question), it would be impossible for any authority to force you to decrypt information that was encrypted using the accompanying public keys. You can't get blood from a stone. But notwithstanding, authorities in the US have been known to force site operators to hand over private SSL keys - perhaps most notably in the case of Lavabit (https://en.wikipedia.org/wiki/Lavabit).

Edit: Thinking more about this - It seems that this question begs another question. I understand that all encryption is done at the client side by your application, and that the private keys used for encryption are stored at the client side as well (a la Proton Mail). But, if your application were to serve some malicious client-side code, would it be possible then for your server to access the client's private keys? If so, then it doesn't seem like it would all that much more egregious for an authority to force a site that operates in this manner to do this, than it is for an authority to force a site to hand over its private SSL keys. I believe this is one of the reasons why Proton Mail setup shop in Switzerland.

2

I am not a lawyer and this is not legal advice. If you are actually going to do this, you should ask a lawyer. The EFF might be able to help clarify things without charge.

The answer will probably be that it varies from place to place, and depends on what legal authority you mean. Different parts of governments have different kinds of authority (the twilio transparency report had some examples).

What you're talking about sounds a bit like the Lavabit case in the US, which is described well and succinctly here. FBI and a federal judge wanted SSL keys, and charged Lavabit $5k/day for not complying until they did. If I recall correctly, Lavabit didn't have adequate legal resources and so their case has left the legal precedent in a somewhat ambiguous state. There is more info on the resolution here.

Based on statements made by Apple about their iMessage encryption, that they cannot be legally forced to perform a wiretap.

Also somewhat related is the UK's RIP, which was used to prosecute people for not giving up encryption keys in 2009. In America, I imagine that such a law would probably be unconstitutional under the fifth.

Again, I think it's important to try to understand these laws yourself and discuss them over beers, but if you ever need to do something that might result in an actual legal disagreement in court, learn from Lavabit and get legal advice and perhaps even a lawyer on retainer before you deploy your system.

Not the answer you're looking for? Browse other questions tagged or ask your own question.