Transparent decryption

Transparent decryption is a method of decrypting data which unavoidably produces evidence that the decryption operation has taken place.^[1] The idea is to prevent the covert decryption of data. In particular, transparent decryption protocols allow a user Alice to share with Bob the right to access data, in such a way that Bob may decrypt at a time of his choosing, but only while simultaneously leaving evidence for Alice of the fact that decryption occurred. Transparent decryption supports privacy, because this evidence alerts data subjects to the fact that information about them has been decrypted and disincentivises data misuse.^[2]

Transparent decryption has been proposed for several systems where there is a need to simultaneously achieve accountability and secrecy. For example:

• In lawful interception, law enforcement agencies can access private messages and emails. Transparent decryption can make such accesses accountable,^[2] giving citizens guarantees about how their private information is accessed.^[3][4]
• Data arising from vehicles and IoT devices may contain personal information about the vehicle or device owners and their activities. Nevertheless, the data is typically processed in order to provide user functionality and also to investigate and fight crime. Transparent decryption can be used to help users monitor when and how data about them is being accessed and used.^[5]

In transparent decryption, the decryption key is distributed among a set of agents (called trustees); they use their key share only if the required transparency conditions have been satisfied. Typically, the transparency condition can be formulated as the presence of the decryption request in a distributed ledger.^[2]

Besides transparent decryption, some other techniques have been proposed for achieving law enforcement while preserving privacy.

• Solutions that allow competing parties to unify their data access policies. Attribute-based encryption with oblivious attribute translation (OTABE) is an extension of attribute-based encryption that allows translation between proprietary attributes belonging to different organisations, and it has been applied to the problem of law-enforcement access to phone call metadata.^[6]
• Solutions that rely on sophisticated cryptography, such as zero-knowledge proofs that the actions of law enforcement is consistent with judge rulings and the actions of companies, and multi-party computation to compute results.^[7]