The ECB provides for secondary legislation to be passed for granting conditional or unconditional approval of cryptography support service providers, handling complaints and disputes and withdrawing licences. This is not to say that unlicensed cryptography support services will not be available and able to provide certificates of authenticity of key holders. Presumably the Government hopes that by making the register open to public inspection and awarding a kitemark, those doing e-business will prefer to do business with licensed providers. The commercial world will dictate whether it becomes effectively essential for a cryptography support service to obtain such a licence. We suspect that it may well prove to be the case that those which are licensed will lose out because they are subject to tighter regulation and therefore unable to compete in terms of price and adaptability to the fast changing e-landscape.
Private keys provide the mechanism used to encrypt data and are known only to the user.
The purpose of this was to enable the authorities to decipher encrypted messages suspected to have been sent for criminal or other nefarious purposes. From the commercial perspective, it is very fortunate that the concept of Key escrow has been jettisoned from the ECB and that a voluntary regime has taken its place. A notice of disclosure may be exercised where encrypted information comes into the possession of a person by means of exercise of a statutory power to intercept, or where it comes into the possession of the by lawful means. However, as an alternative to handing over the key, it is permissible to provide a decrypted version of the information. Any authority which obtains a key pursuant to a disclosure notice is obliged by the ECB to use it solely for the purposes for which it was disclosed, to keep records of how many copies of the key have been made and to whom they have been given.