This says some important things.

Firstly it an admission that GCHQ/MI5 etc lack the computer capabilities and/or resources to crack everyday crypotgraphy. That means that PGP etc really is pretty good.

Secondly it is, on the face of it quite sensible. It places the responsibility for data with the data owner. Many companies simply can’t manage their internal security (hell some can’t even manage basic website security) so they place their keys in escrow. The law is designed to pave the way for forcing the accused to get those keys back not tie up police time and resources chasing rainbows.

The requirement is not an a priori arrangement as many people will assume. You don’t have to hand over keys for all and any encrypted data you have. It is a measure to be used when a crime is under investigation not an open door to give the police unfettered access to company and private data.

But, it falls down on two points.

It creates a crime of not handing over the keys. There are many legitimate reasons to not have keys. Any good security policy rotates keys on a weekly or daily basis for non retained info. And why would you keep old keys, especially if you are up to no good? Thus it makes no distinction between well intentioned good security policy and suspicious behaviour.

It’s based on the investigators assumption. There is no distinction between random noise and encrypted data. If the police come across a block of noise from a random wipe how are they to identify it? They ask the user for the key, and of course there is none, but then a criminal would say that wouldn’t they. Thus, again, there is no technical way to differentiate between illegal and legal activity. One is therefore guilty of a crime (refusing to hand over non-existant keys) purely on the basis of an arbitary accusation.

In summary it has the usual effect of making those who are truly criminal but well informed safer (they will rotate and destroy keys for nefarious reasons) while exposing the innocent to greater chance of injustice and abuse.

Now I’ll tell you, I know a few good cops. They hate this crap. They are overwhelmed, lacking in expertise and resources and completely befuddled by the technicalities and the laws. Most (all normal police but a few uber geek detectives) want to abandon what they see as a huge waste of time chasing technological evidence and go back to old fashioned methods of psychology and human investigation. That’s how you catch criminals.

Which is why this law was obviously not created by the needs of criminal investigation. It is an admission by government that they powerless against criminals who use sophisticated methods and an attempt to change the burden of proof. They need to acknowledge that they have lost this battle and shift resources back into manpower where it can be effective (observation, infiltration, case building).