Select Committee on Home Affairs Written Evidence


21.  Memorandum submitted by Professor Brian Collins

  1.  This is a submission in response to the Committee's Notice of 25 November 2005. It seeks to assist by providing some technical background to two issues:

    —  the need to decrypt computer files; and

    —  the length of time needed to obtain and analyse data from mobile phones.

  I am Professor and Head of Department of Information Systems at Cranfield University based at the Defence College of Management and Technology (previously known as RMCS) at Shrivenham.

  2.  For the avoidance of doubt, this is a personal submission. I have added commentary on the submission of Dr Peter Sommer within my text and referenced his submission accordingly.

  3.  The first question on which commentary is made is that to do with the time taken to decrypt computer files. The time that will be taken to decrypt a file or set of files is unpredictable. If material concerned with the encrypted material (keys, plain text, implementation details showing poor implementation) is found, the decryption times will be of the order of a few minutes in most cases. Historically, as stated by Dr Sommer (paras 14 to 17) decryption processes have worked in most cases for these reasons and in reasonable times (hours at most). What is unclear is whether these times are increasing and the number of cases for which decryption proves impossible is also increasing. I support Dr Sommer in his suggestion that these facts are gleaned from relevant witnesses. (para 17).

  4.  What is clear from the knowledge I have is that the use of encryption processes to protect information on hard disks is becoming more available and indeed is being encouraged for legitimate law abiding users in order to protect themselves from identity theft, spyware and phishing attacks. (Cf http://www.getsafeonline.org/nqcontent.cfm?a_id=1104 published by the Central Sponsor for Information Assurance within the Cabinet Office.)

  5.  Thus I do not agree with Dr Sommer's assertion made in paragraph 15 that the "use of encryption . . . on a hard disk without reason . . . are grounds for suspicion and applications for extended detention". If encryption of material on hard disks becomes the norm as is suggested by Cabinet Office, then it could be seen as necessary for us all to carry justification of doing so. This is tantamount to carrying justification for having on us the keys to our houses and cars, they being the means of protection of our physical assets as encryption keys are the means to protect our information assets. This is unlikely.

  6.  Therefore detection of the presence of the use of encryption will no longer be an indicator of possible malfeasance by itself. Indeed were it to be so, it is likely a rapidly increasing number of legitimate users would be suspected of malfeasance. Furthermore if the use of encryption for legitimate reasons grows as the Cabinet Office, in my view rightly, asserts is desirable, then law enforcement agencies, in the absence of any other indicators of suspicion, will need to decrypt that material to find evidence of possible malfeasance. This tension in Government policy between law enforcement and supporting secure business practices has existed for many years but is only now, due to technological advances, becoming significant. Looking first for other suspicious indicators to justify subsequent decryption may be a more profitable route under these circumstances.

  7.  The case that is made by Assistant Commisioner Andy Hayman for extended detention to allow a greater probability of decryption of computer files then seems to me to rest on two factors; one that the decryption process is more likely to provide significantly more evidence in 90 days than 30 and two on the likelihood that encrypted material hides suspicious activity in the first place. It is my view that if decryption works at all it will work in hours, and if it does not work in that time then the unpredictability of decryption processes based on brute force techniques (cf Peter Sommer para 16 last bullet with which I agree) is at best a weak justification for an increase in detention time. Without the statistics for decryption times, resources available and numbers of concurrent cases it is not possible to work out the advantage of 90 days over 30 days. The Committee may choose to enquire whether such statistics are available.

  8.  The second factor of encryption hiding suspicious activity as a justification for extension seems to me to be even more tenuous. It is more likely that other evidence would make the case for detention in the first place and that encryption is included as a secondary factor. If the use of encryption for legitimate purposes becomes more widespread using its existence on storage media as a prima facia case seems to me to be ill founded.

  9.  The second question on which my opinion was sought is the length of time needed to obtain and analyse data from mobile phones. The question breaks into a number of parts (1) the nature of the data, calling information (traffic analysis) or content (see Peter Sommer paras 22 to 24), (2) the means by which it is "obtained" and (3) the depth to which it is analysed. These will be treated in turn.

  10.  One of the factors involved in determining the time taken to obtain the requisite data of any type is how much "metadata" is available to help the "finding process". Examples might include number called, number calling, location, time etc. It is to be noted that in 2004 the useage of mobile phones in UK was 62 billion minutes per year (http://www.mobilemastinfo.com/information/history.htm)

  11.  The elapsed time for the finding process in this volume of data depends critically on reducing the "search volume" with prior "metadata" and on the resources (computers, networks and advanced software) allocated to this process by the owners (strictly collectors) of the data, that is the mobile operators.

  12.  It will also depend upon how many operators are involved and what jurisdictions they are in (this influences how quickly they can start and what authorities they need to do so).

  13.  The nature of the data requested will also affect how long it takes to acquire it; traffic flow data is distributed throughout the systems of the operators concerned and may take some time to acquire, but is not seen as a major invasion of privacy by end users so collation of it could start as soon as the metadata to support the finding process is assembled; content on the other hand will probably only reside in the systems of the two operators with which the end users have accounts; but content of a call is regarded as sensitive by end users and hence warrants may be necessary for access depending upon the jurisdiction in which it is stored.

  14.  It is clear therefore that predicting the time to obtain the data of whatever type is not possible. What is clear is that the volume of data within which the desired information resides is increasing rapidly and that the complexity of the data structures is increasing also. Without improvements in finding techniques it is clear that finding times will go up also. Hence there appears to be a reasonable case for increasing detention times whilst this process is completed. However, the Committee might like to enquire whether the Home Office is exploiting current research aimed at finding new and much faster ways of finding information in large volumes of data as an alternative to the need for increased detention times. (eg Exploitation of AKT: www.aktors.org/akt/objectives)

  15.  The time taken for analysis will depend upon how many staff with the requisite expertise and experience are allocated to any given case. It is impossible to predict how long this element of the overall process will take, but it is clear that as the complexity of material goes up so will the time for analysis; again, development of advanced tools and their widespread use would ameliorate the situation to some extent, but this also depends upon trained individuals in some considerable numbers being available.

  16.  The issues raised by Peter Sommer in para 28 of his submission are also particularly important. Most telecommunications systems and data communications systems will converge on to one global infrastructure in the next few years. The separation of what is content and what is traffic information will (and is already) becoming very difficult. This has legal as well as technical implications. Without global agreements on all aspects of law enforcement, use of intercepted material obtained by whatever means will become more and more problematic. The case for extended detention periods based on technology innovation outstripping legal instruments will then look ill founded, unless technology in support of law enforcement is used effectively.

30 January 2006





 
previous page contents next page

House of Commons home page Parliament home page House of Lords home page search page enquiries index

© Parliamentary copyright 2006
Prepared 3 July 2006