Role of Encryption in Cybercrime

Encryption will become an increasing presence in cybercrimes for a number of reasons. Encryption is an excellent method for protecting data from prying eyes. In most cases corporations will use encryption to protect data from criminals, but now criminals are implementing encryption to cover their tracks and hide illegal material such as child pornography and copyright infringing material. Encrypted data is extremely difficult to decipher without a decryption key, and the technical means to do so is well beyond most law enforcement resources.

Current laws do not include any provisions forcing individuals to release their decryption keys or passwords. In some landmark cases, judges have either mandated individuals to give up their passwords, or exclude encrypted data from incriminating evidence. In most cases, defendants have claimed the Fifth Amendment, claiming that being forced to give up their encryption key effectively incriminates themselves, which is unconstitutional. In other regions around the globe, some governments have implemented “mandatory disclosure laws”, which forces an individual under law to decrypt their data as evidence. In the In re Boucher case in Vermont (United States District Court for the District of Vermont, 2009), the District Court overturned a Magistrate’s decision to uphold the Fifth Amendment by claiming Boucher was only required to reveal the unencrypted contents of the laptop hard drive, not reveal his decryption key. Incriminating evidence was discovered and he was sentenced in 2010.

Until mandatory disclosure laws are universally implemented across the country, cybercriminals will implement encryption in more cases, due to the obvious advantages encryption provides in committing cybercrimes.