I am a PhD student at a German university. Motivated by a longer absence of a (technical) coworker due to illness, the accessibility of data of the members of my institute has been discussed for such cases. My computer is owned by the institute, but I am the only one using it, and I have completely installed and configured it to my liking. In particular, I am encrypting my data. I do have some private data on that computer as well, e.g. emails since my private email account is linked in my email program, but also some music, and perhaps a few photos, my private PGP key, etc. The setup is pretty similar to some of my colleagues.
Now, I was asked to either physically or digitally hand over my private encryption key (or password) in order to get access in some emergency case. Apparently, my colleagues have done so already. I feel very strange about this, since I grew up learning that passwords should never be given away. I have raised my concerns, e.g., that this would also enable access to private emails or other data, and allow to send emails in my name. But these were marked invalid, since private data has nothing to do on my work computer (even though everyone uses it that way). Alternatively, I was told I could unencrypt my hard drives.
My questions are:
- Am I required to hand over my private encryption key by law?
- Morally, how would I best act in this situation?
- Should I hand over a wrong (digital) private key and hope that this situation would never happen?
- Instead of rebelling, I am thinking to give access to part of the system only, i.e., put certain data in an encrypted container that they cannot access? I do not have to mention this anywhere if I hide the container good enough...(maybe that is not even necessary).
It is probably worth to note that no one is really involved in my research topic, i.e., no one really depends on my data. I could however imagine someone to be interested in possible (unpublished) results in the case I am gone.