the regulation of investigatory powers act 2000 (ripa), part iii, activated by ministerial order in october 2007, requires persons to decrypt information and/or supply keys to government representatives to decrypt information without a court order. failure to disclose carries a maximum penalty of two years in jail, or five years in the cases of national security or child indecency. the provision was first used against animal rights activists in november 2007, and at least three people have been prosecuted and convicted for refusing to surrender their encryption keys, one of whom was sentenced to 13 months' imprisonment. even politicians responsible for the law have voiced concerns that its broad application may be problematic. (9) of section 49 failed to consider that mere authentication can be used in a way analogous to encryption, making it possible to circumvent the law via chaffing and winnowing.