Lawmakers consider bill that would keep private keys private in Rhode Island

This story was originally published by the Rhode Island Current.

For the third consecutive year, Rhode Island lawmakers are considering a bill that would draw firmer boundaries around one of the most sensitive pieces of digital life: private keys.

Private keys are a type of credential used in cryptography to protect digital communications, identities, accounts, and assets like bitcoin wallets or other cryptocurrency holdings. Bill H7957, led by Woonsocket Democratic Rep. Stephen Casey, would preclude courts and government agencies from forcing someone to hand over a private key tied to these digital properties.

“It’s more like your private property,” Casey said in a phone interview Monday about what the bill seeks to protect. “Somebody confiscates your cell phone and you have all your digital assets on there. They shouldn’t have access to that without really due process.”

Under the proposal, courts and government agencies could still subpoena or otherwise seek information about or seize a digital asset. But these entities would be limited in what they could ask for or control if the asset can be accessed via a private key. That’s because private keys can unlock access to more information or data than is needed or relevant for a specific investigation. Often, a matching “public” key used to access the same asset may supply the desired information. 

The bill went before the House Committee on Innovation, Internet and Technology at its first meeting of the year on Thursday evening, March 5. Like last year’s hearing on the same legislation, the House tech committee received a refresher course on how private keys work. 

Andrew Begin — a cryptocurrency activist and organizer with RI Bitcoiners —came to testify for the second year on the legislation. Begin likened a private key to a key for a safe. 

“It would be weird to give somebody else your key to that,” Begin said.

In public-key cryptography, private keys are matched with public keys. The shareable public keys can be used to send or receive assets or messages, while private keys that are closely held by their owners often give access to entire accounts or stores of information, rather than just single transactions.

Begin gave two-factor authentication — known to most people as the codes sent to your phone or email when logging into an account — as another example of “some things we keep secret.”

“With bitcoin and digital assets, those are like a safe,” Begin said. “Your private key is just 12 words or 24 words, and you write them down, and you don’t take a picture of them, you don’t say them out loud if you’re talking to Alexa, you don’t save them in Google Drive. Because once a private key is exposed to one person, you can consider it exposed to the entire world, and then the assets will be gone.”

Lone bill sponsor Casey likened private keys to Social Security numbers. The bill is essentially privacy legislation, he said, it’s one of several crypto-related bills he’s submitted in recent years. Casey said he’s not a crypto investor himself, but after meeting with crypto activists in recent years, he sees their efforts as possibly helping Rhode Island’s economy “move into a digital age.”  

“Everybody else has somebody who’s pulling for them,” Casey said. “So I’ve submitted the legislation over the last few years, and I’m still learning more about it.”

Begin characterized the legislation as not just protective but also educational. It’s a way to send “a strong message that the state respects your property, and the state will go through appropriate processes regarding transactions and assets,” Begin said.

Modeled After Wyoming Legislation

Another bill by Casey that would establish a special legislative commission to study blockchain technology and cryptocurrencies was also heard last Thursday. Casey’s bills have usually been mirrored on the Senate side by Sen. Lou DiPalma, a Middletown Democrat and Raytheon engineer. 

Joining Begin in support for both of Casey’s bills was Dan Hersey, founder of the Rhode Island Bitcoin Policy Initiative, whose website notes it has helped draft the crypto-related bills that appear at the Rhode Island State House. He noted that DiPalma’s bill to create a blockchain commission passed the Senate floor last year. “It never received a vote in the House,” he said.

Hersey testified that taking crypto seriously was one way Rhode Island could work toward benefitting “from blockchain and the cryptocurrency economy while protecting consumers. He also testified in support of the private key bill. 

“Compelling someone to hand over a private key in a proceeding about a single transaction is akin to demanding the deed to someone’s house when the court only needs their mailing address,” Hersey said. 

Hersey called the private key bill “a proactive measure” that still allows courts and agencies access to information they need about digital assets. 

“There’s no doubt they should be able to get that, but they should not be forced to demand the private key itself,” Hersey said. “And that’s where this bill draws the line.”

Hersey said the Rhode Island legislation is modeled closely after a similar bill passed by Wyoming’s legislature in 2023. Like that law, the Rhode Island proposal would suppress official demands for a private key “unless a public key is unavailable or unable to disclose the requisite information,” the bill reads.  

“It’s not an absolute shield, but is more so a sensible default,” Hersey said.

Randall Rose, a former software engineer, testified in support of the bill but shared his “slight criticism” of its wording. The bill, he said, never defines what a “public key” is, which Rose argued could confuse legal interpretations and create the very outcomes the bill wants to prevent. Courts and officials, Rose thought, may rely on the typical meaning of “public” rather than its specific cryptographic definition.

“Sometimes you want only one person to have a private key, and 20 people to have a public key,” Rose said, “Then the quote/unquote ‘public key’ is not really public in a legal sense.”   

Rose argued the bill is really about aligning subpoenas and investigations more closely with modern encryption systems, which rely on private and public keys for much more than cryptocurrency.

“When police agencies are doing a search or somebody’s executing a subpoena or doing discovery, they tend to just grab all the information indiscriminately,” Rose said. “And that’s just not in tune with how modern technology works.”

The bill, he added, “doesn’t really get in the way of anything worthwhile happening” when it comes to investigation. Instead, it draws a line at the public key, “if that’s enough to get the information you need.”

A Senate duplicate of Casey’s bill — once again sponsored by DiPalma — was submitted in late January but has not yet been scheduled for a hearing. 

As is standard practice for bills upon introduction in a committee, Casey’s legislation was held for further study Thursday.

Rhode Island Current is part of States Newsroom, a nonprofit news network supported by grants and a coalition of donors as a 501c(3) public charity. Rhode Island Current maintains editorial independence. Contact Editor Janine L. Weisman for questions: info@rhodeislandcurrent.com.