(Cryptography) - Sending Encrypted Messages Online
<p>Is it legal to send encrypted messages (specifically using RSA key-pairs and AES 256) online in Canada and the USA?</p>

<p>Also, can law enforcement request it to be decrypted without probable cause?
<br><br><br>
PS. The messages being sent are generally not confidential (eg. chat messages). This is a measure so that if a confidential message is sent, it would be between a mass of non-confidential messages (therefore harder to find the confidential messages, if any).</p>

<p>This may also extend as a second layer of security (eg. if an unauthorized user has gained access to one of my accounts, they would not be able to read the messages sent / received)</p>

<h1>Summary</h1>

<ul>
<li><strong>Encryption legality:</strong> Sending encrypted messages is legal, but exporting advanced cryptographic technology is regulated</li>
<li><strong>American law enforcement:</strong> Probably cannot obtain decrypted data due to the Fifth Amendment, though it's an open question</li>
<li><strong>Canadian law enforcement:</strong> Can obtain decrypted data given reasonable grounds and when you are not under investigation (i.e. it's for the purpose of investigating someone else)</li>
</ul>

<h1>Legality of Encryption</h1>

<p>As pointed out in the comments, encryption is used daily by many in North America. This happens when browsing the internet, using Skype, electronic banking, etc. In Western countries at least, sending encrypted messages is generally legal.</p>

<p>What is regulated, however, is the export of the crypto-technology itself. This is handled through the <a href="http://www.wassenaar.org/index.html" rel="nofollow noreferrer">Wassenaar Arrangement</a>, an arrangement between 40+ countries, of which Canada and the US are a part. The arrangement deals with the exports of conventional arms and dual-use technologies, including cryptographic technologies. The relevant portion is Control List 5, part 2. It contains an exception in Note 3, essentially stating that widely available cryptographic technologies are left uncontrolled.</p>

<h1>American Law Enforcement</h1>

<p>As pointed out in the comments, the American perspective has already <a href="https://law.stackexchange.com/q/1523/">been addressed</a> on this site. Briefly summarizing Mark's and cpast's answers there: </p>

<p>While the issue has not yet reached the Supreme Court, it appears requesting decrypted data violates the Fifth Amendment. There may be an exception though, when the document's general contents are already known.</p>

<h1>Canadian Law Enforcement</h1>

<p>In Canada, The general way to compel someone to give documents or data is through a Production Order defined in <a href="http://laws-lois.justice.gc.ca/eng/acts/C-46/page-257.html" rel="nofollow noreferrer">§ 487.014</a> of the <em>Criminal Code</em>. There are a few types of production orders, but I'll cite the general one:</p>

<blockquote>
  <p>(1) Subject to [the more specific production orders], on <em>ex parte</em> application made by a peace officer or public officer, a justice or judge may order a person to produce a document that is a copy of a document that is in their possession or control when they receive the order, or to prepare and produce a document containing data that is in their possession or control at that time.</p>
  
  <p>(2) Before making the order, the justice or judge must be satisfied [...] that there are reasonable grounds to believe that (a) an offence has been or will be committed under this or any other Act of Parliament; and (b) the document or data is in the person’s possession or control and will afford evidence respecting the commission of the offence.</p>
</blockquote>

<p>There is no specific reference to decryption here, but I believe (1) implies it must be done: if you are able to decrypt a message, you are in possession/control of the data. However:</p>

<blockquote>
  <p>(4) A person who is under investigation for the offence referred to in subsection (2) may not be made subject to an order.</p>
</blockquote>

<p>Because the suspect cannot be subject to the order, the main use case of production orders is to compel third parties to produce documents/data that would aid in prosecution of the suspect. </p>

<p>The third party is afforded some protection under <a href="http://laws-lois.justice.gc.ca/eng/acts/C-46/page-261.html" rel="nofollow noreferrer">§ 487.0196</a>. They cannot refuse the order on the basis of self-incrimination but if the compelled documents/data happen to incriminate the third party in some other offence, that evidence is not admissible against them (except for cases of perjury). Note that this is very similar to the provisions provided for in Charter sections <a href="https://en.wikipedia.org/wiki/Section_Eleven_of_the_Canadian_Charter_of_Rights_and_Freedoms#Right_not_to_be_compelled_to_be_a_witness" rel="nofollow noreferrer">11(c)</a> and <a href="https://en.wikipedia.org/wiki/Section_Thirteen_of_the_Canadian_Charter_of_Rights_and_Freedoms" rel="nofollow noreferrer">13</a>.</p>

<h1>Self Incrimination Note</h1>

<p>Tangentially, this answer touched on a key difference in self-incrimination law between Canada and the US. In the US, you can plead the Fifth in <em>any</em> criminal proceeding. In Canada, you can only do so in your own, though what you reveal otherwise is not later admissible against you.</p>

united-states criminal-law canada privacy cryptography