Slashdot Mirror

Hopefully all UK net users have already seen the following, but it's worth pointing out just the same:

Gasp in awe as you watch Jack Straw, Home Secretary of the UK (ie, important government chap), find himself liable for two years imprisonment (if this law was to pass) because someone sent him an encrypted message that he can't decrypt.

This law is really so incredibly fscked, and demonstrates a completely lack of understanding, on par with the 'net filtering legislation that's just come in to effect in Australia (Oz /.'ers: what's happening down there?).

...j
(an Australian living the UK)

I agree! See the links under 'Re:Critical "source codes"?' for details of previous scare-stories from The Times, and see Stand for details on the legislation.

The Jack Straw letter was mentioned in a previous slashdot story and included links to the
letter and the photo essay.
---

The Jack Straw letter was mentioned in a previous slashdot story and included links to the
letter and the photo essay.
---

For your info, you might like to have a look at stand.org.uk's website. They are a campaigning organisation raising the awareness of privacy and crypto issues in the UK... Interesting reading.

That'll be why we looked down our noses at our government and politely told them to fuck off whereupon they promptly did.

The UK government scrapped the whole mad keys idea last week. This story is very old, very out of date, and very not valid anymore.

Isn't it about time Slashdot got a European correspondent to stop this kind of confusion?

--

This was scrapped last week. See:

www.theregister.co.uk/991122-000008 .html

"The controversial Part III, which dealt with police seizure powers for encryption keys, has been shifted into a separate Home Office bill"

ie. they're reviewing it after www.stand.org.uk pointed out Part III was bollocks.

--

Someone else already posted the link to http://www.stand.org.uk, but I thought it deserved some emphasis. Their latest bit of campaigning was to send Jack Straw a letter which, if the legislation were to pass as proposed, would leave him liable for a two year jail sentence.

"Dear Mr Straw,

Please find at the end of the letter a confession to a crime, which has been affirmed by Statutory Declaration. The Commissioner of the Metropolitan Police has been informed that you are in possession of this information.

You will not be able to understand the confession, because the words have been scrambled using a strong cryptographic key. This key was created in your name and has been registered on international public key servers..."

STAND is the main campaigning organisation in the UK tackling the issues raised by this bill, and it's a very well done website by some very clueful people. Visit it, everyone!
--

the PTA was passed by a Labour government, not a Conservative one.

Stallmann never actually says this, although his wording is admittedly very unclear: What the previous (Conservative) government did do was to begin the removal of a right to jury trials for all criminal offences.

IANAL, but:

• We never had a right to juries for all offences, as the more trivial have been dealt with by magistrates since time immemorial.
• We aren't losing the right to jury trials, just the right for some offences (which ones, aren't yet clear)

That said, it's a bad rule, which is part of an even worse bill. This government is shaping up to be worse than the last one, and Jack Straw is one of the most centralist, controlling, power-crazed and even downright fascist Home Secretaries we've ever had (including Michael Howard). I don't claim to understand it, but a government which is generally spineless seems to regard it as important to impose draconian rules on almost everything.

Why just write to an MP when you can Adopt An MP

Not all the Bad Bills come from Redmond

Take a look at www.stand.org.uk for more information on why this bill is so braindead.

I was thinking that an even better activity would be a "[inter]National Crypto Day", when we all send each other lots of encrypted messages. In fact, I just sent the following message to a friend of mine (it's a private message, but I don't see any harm in posting it here):

btfzuqhqzeclyfvchjxgdrkpetnwbvosxfqswbv
upashzmbrexhinncdshzutjnlizgmzntgwgyqmr
tqklcsncasicehglnsslprhhjlgbflsoarsukuf
ytlupzwwhkjxhtsydpnodnapgcajjeeowbpmpkw
hprrdonbijmyhbpiurzkroajcxbhsfzxivjorho
uokreaftfhuygtleqeejovbjhsspiaxpgtztejx
tyzyprwuyoeaczpjmhbrjptxmjhxhubocfjtuce
ncijzzejaterdyqzzqvyjfcwydiwopoqcjttscq
lbuurunpkpzluripwnclvkubdzjoocvtifknbpm
mwnrwqzpwznrlwbcqavnyjbtuknyusdlwbuuoer
rbhvghjatdqnqjxvmznkbswsdgoraifwxavemnr
rrdlnffgijxtyelixvlyilrrdswlnmblhyvrmvn
ggubrlgwhewnjpoidkstnhnlcbmkuqjvegknufw
zcwlkwdhkwqzrkpbmoirbigdxidyamnvw bxkid
mkacukj

This would seem to be even more effective than "M-x spook" - style keyword spoofing, since we'd really be showing that "they" can't read our mail if we don't want them to, and exercising our right to send mail that they can't read.

Additionally, I would suggest sending some messages that are just randomly-generated gibberish. This would be a response to any proposal to ban crypto: it would make the point that you can't prove that a given message consisting of seemingly-random data is actually a ciphertext at all, and not really just random. Banning the transmission of meaningless random numbers would be absurd, which means that banning the transmission of ciphertext would be impossible. Suppose I had sent the following to my friend instead:

lrfkqyuqfjkxyqvnrtysfrzrmzlygfveulqfpdb
hlqdqrrcrwdnxeuoqqeklaitgdphcspijthbsfy
fvladzpbfudkklrwqaozmixrpifeffeclhbvfuk
byeqfqojwtwosileeztxwjlkngbqqmbxqcqptkh
hqrqdwfcayssyoqcjomwufbdfxudzhiftakczvh
sybloetswcrfhpxprbsshsjxdfilebxwbctoaya
xzfbjbkrxirimqpzwmshlpjhtazhbuxhwadlpto
yeziwkmgsovqzgdixrpddzplcrwnqwqecyjyibf
jykmjfqwltvzkqtpvolphckcyufdqmlglimklfz
ktgygdttnhcvpfdfbrpzlkvshwywshtdgmbqbkk
xcvgumonmwvytbytnuqhmfjaqtgngcwkuzyamne
rphfmwevhwlezohyeehbrcewjxvceziftiqtntf
srptugtiznorvonzjfeacgamayapwlmbzitzszh
zkosvnknberbltlkggdgpljfisyltmmfvhybljv
kypcflt

I would be seriously impressed if anyone (aside from myself or my friend) could prove that the first is a secret message, let alone tell me what it says. However, neither can I prove that the second is not a secret message (in fact, you don't have to believe me when I claim that), so if they were to reverse the burden of proof, I would have a problem -- they could punish me for refusing to surrender a non-existent key. See this story from a couple weeks ago.

Of course, all this assumes that there really is a "they" trying to read everyone's mail -- I'm stating no opinion on that.


David Gould

People committing criminal acts in the name of fairer laws have not been tolerated since the Suffragettes, don't you know!

--- Coward is as Coward does.

http://www.stand.org.uk/dearjack /images/swear1.jpg

Given this carelessness, finding out who the 'mystery man' is becomes much easier. :)

IANAL and I know absolutely nothing about British, European or Internation law, but a little searching turned up this. http://www.stand.org.uk/index-update2. php3#top

Part III Investigation of Protected Electronic Data

The spooks' charter. Here any policeman could show up with some encrypted data and an order to provide the decryption key. If you refuse you go to jail for 2 years. Usually they won't need a judicial warrant; sometimes they won't need any sort of warrant at all, just their say-so.

The problem is that if you don't actually have they key it is up to you to prove that. If you deleted it, or if you never actually had it, you're in trouble. If the authorities reckon you've got it stashed on a floppy buried in the flowerbeds at Hyde Park Corner, go directly to jail, do not pass Go, do not collect £200.

How can you prove you don't have something? Try slapping your forehead in a manner likely to convince the judge.

The other new power here is that the authorities can order you to keep the disclosure of your key a secret. If you tell anyone at all you'll be going down for up to 5 years for "tipping off". Not only is this disasterous for information security, but it even stops you complaining about unfair treatment. Toddle off to court to demand judicial review of the order to disclose and all you'll get from the Judge is an extended stay in Her Majesty's finest accomodation because telling the judge is illegal!. There is a tame Tribunal to hear complaints and cover them up; you aren't even entitled to legal representation at it.

STAND says, poetically: How does Part III breach the Human Rights Act, let me count the ways... Unfair offences, reversal of burden of proof, defences that are logically impossible to prove, a wholly inadequate complaints procedure with no appeals, unneccesarily broad powers, potential to force you to incriminate yourself, the list goes on.

The police need something to help them to decrypt data in certain circumstances (and not in others). Part III is not it. Parliament should delete this Part and try to come up with something better when it replays the Interception of Communications Act next year. If it doesn't throw this Part out, the European Court of Human Rights will.

Sounds to me like they do have some sort of legal leg to stand on. (With the European Court of Human Rights?)

In the UK we have been having arguments over similar stuff for a while now. A group has formed called Stand. You can check out their philosophy here.
The principal is that MPs (a bit like your senators of something) have ways around huge mailbags of complaints about the same thing - whether electronic or whatever. They'll get pissed off, filter the messages, and write back to everyone with some condescending thanks for your ideas. Stand has organised for groups of concerned constituants to send only one full, explanatory letter to each MP and then anyone else who agrees can write a brief note saying so.
You might find a similar approach will work better.

UK readers might be interested in going to the http://www.stand.org.uk website and "@dopting" their local MP, especially if your MP is currently in the list of unadopted MP's.

UK readers might be interested in going to the http://www.stand.org.uk website and "@dopting" their local MP, especially if your MP is currently in the list of unadopted MP's.

Hi We are having similar issues here in the UK and Europe. Checkout Stand.org for a nice idea on how to corral support. Martin

If you live in the UK you can do something about these ridiculously boneheaded proposals (`duh, if we can't think of anything we'll, er, um, we'll just take the stupidest option...') -- register at stand.org.uk and prepare to lobby your MP. If it's good enough for Alan Cox surely it's good enough for you?