Do you need to register as a Cryptography Provider?

You need to register as a cryptography provider if you provide encryption-related products and services or electronic-signature-related offerings. Cryptography and encryption present a challenge to security-conscious governments in that it allows you to conceal your message content from the authorities. The laws around cryptography help the government regulate this situation, but in doing so, create various issues for a cryptography provider. For example, if the law requires you to register, where do you begin? What are the different steps? How does the process work?

What laws must a Cryptography Provider comply with?

There are different laws regulating cryptography in different countries. In some countries the laws even require you to provide the investigative authorities with back-door access to your encryption solution, or to make your encryption solution less high-end. In South Africa, for example, The ECT Act even requires you to register if you provide digital signatures or digital certificates, as they are clearly products that assist others encrypt data.

However, it gets more difficult to know whether to register or not where encryption only forms a small part of the service you provide – working as a backup service, perhaps. So we are saying that there is a difference between providing an encryption service (where the product or service assists others to encrypt data) versus an encryption element within a service.

But we are not saying that you should not register. There is a risk of being guilty of an offence and being liable to imprisonment for a maximum of two years if you do not comply with the ECT Act. Registration is the safe course of action where you are uncertain about whether or not the ECT Act requires you to register.

Actions you can take

Find out more about the laws that regulate cryptography and what services we offer to help you comply, by asking us all your questions.

What is the purpose of these laws?

While there may be different laws regulating cryptography around the world, the one thread that connects all these laws is that governments are trying to make the investigation of crime easier. In other words, any law that requires you to register before you can provide cryptography products and services aims to assist the investigative authorities in the event of any threat to national security by decrypting encrypted messages. In such an event, he investigative authorities simply look in the register of cryptography providers and see who provided the cryptography product or service and, then, require that cryptography provider to help the authorities decrypt the encrypted message.

Interested?

If you are interested, please complete the form on the right or enquire now. We will contact you to find out more about your requirements and give you a quote.