Slashdot Mirror
UK Decryption Law Pushed Through
Joel Rowbottom writes, "After all the lobbying and protests from the 'Net community over the past year, the UK government has still published The Regulation of Investigatory Powers Bill. If this becomes law then you could be sent to prison if your data is encrypted and you refuse to either supply the key, or the plaintext versions. If you're in the UK and you haven't done so yet, write to your MP and let them know your feelings on the subject! "
I think that once this gets to the types of folks who have everything to hide (IE, the people who would sign this into law) it would be killed.
Not that you shouldnt go right now and complain to someone about this. You should!
They are a threat to free speech and must be silenced! - Andrea Chen
Fish! LipHo
If this becomes law then you could be sent to prison if your data is encrypted and you refuse to either supply the key, or the plaintext versions.
I guess if I knew a lot about encryption, I'd know the answer to this, but is there any way to verify that the plaintext version you supplied matches what's been encrypted? Certainly if this law were algorithm agnostic, then there would be no way to verify this.. (just say "I used a one-time pad, which I will not supply. Instead I will provide you with a plaintext version of it.") That seems to me to remove all of the teeth from this otherwise god-awful law.. am I mistaken?
Trees can't go dancing
So do them a big favor
Pretend dancing stinks!
Now is the time for everyone in U.K. to brush up on Steganography.
---
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
In any case, the problem is more that it is a crime to hold encrypted data and not handing over the decryption key even if you never had the key!. That is why the bill is ill thought out.
--
/* Disclaimer anything said in the below post is something that I personally believe and as such may offend persons who have vested interests in the concept of cryptography. If this offends you realize that it is indeed a valid opinion */
I would think that in fact the average person has no use for cryptography in their daily lives. I don't mostly because I really don't know anyone and have never had the need to use communications media to interact with individuals in a private way. Generally I think that if I have a choice between using cryptography or going to prison I will choice to not use it.
The ultimate question is why would anyone really care about you so much that you need encrypted data anyway? If you are being monitered that closely you should run far, far away and never return.
Cryptography is only useful if you happen to be a spy or have an actual internet connection (ie the use of pgp to sign, encrypt, or both messages with it). Most data that you have is not really that interesting.
Slashdot social engineering at it's finest
Doesn't this conflict with the Human Rights? I would treat my encrypted data the same as the right not to answer questions (although looking at thier anti-terrorist laws that didn't stop them removing the right to silence and juryed trials.)
Heard on the news yesterday the the Scottish courts have rendered the law on speed cameras obsolete (in Scotland anyhow).
AFAIR the argument went as follows: If your car gets caught on a speed camera the UK law requires the owner to identify the driver at the time so that the fine/license points can be levied at the appropriate person. If you refuse then the owner gets the punishment.
However, the Scottish courts (which are independent of the rest of the UK legal system) have noticed that the European laws say that no-one is obliged to incriminate themselves - it's the responsibility of the accusers to gather enough evidence to find them guilty.
Thus, in Scotland at least, if you get snapped by a speed camera, then the right defence is to not to deny you were the driver but simply to refuse to incriminate yourself. Then under Euro law they have no right to fine you.
Now this has to also apply to this data encryption business doesn't it? Just tell you refuse to incriminate yourself (by giving them the key) then they'll have to try and crack it themselves, not just punish you anyhow.
(I guess this is equivalent of "pleading the 5th" in US?)
Regards, Ralph.
Store your data on DVD's. Encrypted with the MPA keys. And lose them regularly.
Baker's Law: Misery no longer loves company. Nowadays it insists on it
http://www.sigsegv.cx/
One password that will decrypt the real data and one that will decrypt harmless cooking recipies AND destroy the original.
Obviously this would only be intresting for the real criminal, that stand more to lose from his files being decrypted than from losing them altogether.
Yes, I'm sure that the really ugly guys(tm) won't get caught by this law, only innocent geeks refusing to decrypt as a matter of principle and the clueless criminals.
Perhaps starting rumours about how a few MP's have suspicious material on their computers wouldn't be too bad. ;-)
All opinions are my own - until criticized
I'll do it for cheesy poofs.
This law effectively makes DeCSS legal in the UK. Since the law requires that (on demand) we hand over encryption keys to any encrypted data in our possession, they can hardly justify putting us in jail for having the key in the first place.
I quote the relevant part:
It's when you combine it with other things, that problems arise. The European Privacy Laws, for example, dictate that you cannot export data to a country with weaker privacy protection. On that basis, the Government is entitled to export information seized from individuals to other nations, WITHOUT legal reason or basis but for commercial gain.
(This follows, as the ability to seize personal information on a computer by the Government, without due process, is tantamount to saying that the data is not protected by privacy laws. Thus, it may be exported freely.)
Then, combine it with the CCTV cameras, now filling England. These images can (and are) sold to commercial enterprises. Information from the cameras is index-linked to the national criminal databases. Imagine being able to demand of your ISP all encrypted data in and for your account (such as your password), and being able to tie all that information with everything on your harddrive and THEN everything about your movements in the country.
THAT is when it gets scary. Someone with protest e-mails who happens to be heading in the direction of a town in which the Government knows nuclear material is illegally being transported could end up being arrested under the Criminal Justice Act, or even the Terrorism Prevention Act, with the e-mails used as evidence against them, even if their sole purpose for driving there was to pick up a bar of soap.
The combination of the loop-hole in the privacy laws, the CJA, the TPA and the 24/7 surveilance lead me to believe that Britain is plunging towards being a totalitarian state. And, to be honest, I don't think it's the Government's fault.
This attitude was shared by the previous Conservative Government, just as feverently. Indeed, it was they who put all the pieces in place to allow this new law to be abused.
This leads me to believe that it's actually the Civil Service that's actually running the show. They are now in a supremely powerful position, with absolute, dictatorial powers of monitoring, searching, and arresting, with NO due process taking place. In short, the Civil Service in England would be capable of seizing total power over England, at this point, and there would be no realistic way to stop them.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
-jwb
Look at http://www.stand.org.uk/ - this is an important site.
They show how to get Jack Straw (important government chap in the UK) guilty of committing a crime. That is, they encrypted a confession to an actual (undisclosed) crime, destroyed the key, and sent him the encrypted data. Jack Straw is now in possession of some information that would pressumably be of interest to the police, but he is unable to provide the decryption key (because he never had it in the first place), but, ofcourse, as many people are pointing out, how do you prove you don't have the key...
While the example of the above site is, considering the circumstances, a fairly light-heated example, consider this: lots of politicans/business people (or anyone, really) are accussed, and investigated, of serious crimes regularly. How easy will it become to provide encrypted data to the person under investigation, without their knowledge, and then inform the police that that person is in possession of encrypted data that may (or may not? who can tell?) be of interest to their investigations. Police find data, ask for key, person is flung in jail.
Ooops.
I really hope Mark Thomas can squeeze a show in about this before the current season ends - I believe the shows are still being taped. (Mark Thomas is similar to Michael Moore, for you US people - only much, much better at what he does.)
...j
Somehow it's making more and more sense that Orwell's novels were set in England. Yes, I know he's English, went to Eton, all that, but he made a point of setting his novels there, rather than in some made-up country, first to make his message particularly poignant to his homeland's readers, but also because he saw the real possibility of it happening there. Shame people stopped listening about twenty years ago.
English police don't need a search warrant to enter a home. Private ownership of guns of any sort is strictly controlled. The government has granted itself the right to read any electronic message and imprison you for years if they can't read it. God help you if it's white noise or if the file got corrupted. And there is legislation in the works to require every subject (interesting word, that) to submit a DNA sample to a national database.
--
This is not my sandwich.
With PGP, and no doubt many other encryption schemes, this would not prove anything. The encryption program chooses a random session key to encrypt the data, and encrypts this session key with the user's key.
Of course the real flaw is that it would require both the plaintext & the key, while the OP was suggesting giving only a bogus plaintext.
Here (Sweden) it is actually *illegal* to even try to find out who a journalist's source is.
The real problem (as you pointed out) is that you can never prove that you do *not* have encrypted information. Hey, there might be a secret message hidden in this post. Perhaps I made the arrangement that "Start selling those drugs to children the moment I post three messages on the same subject on /."
The obvious conflict (and now my rant alert is flashing) is that the openness of the "net culture" makes it more motivated to encrypt and hide personal data. I might not want the whole world to see my private mail, however innocent.
Perfect crypto vs total freedom of information. It is just like that "Irresistable force vs unmovable object" question.
All opinions are my own - until criticized
The US isn't doing to well on 'innocent until proven gulity' either. If a cop decides that it's suspicious that you take money to Las Vegas to gamble with, or that it's possible to use an innocent item in a drug related way, then you can loose all your assets.
Say I'm in the next room running a packet sniffer.
Say you're _not_ using encryption, like a dumbass.
Say I steal your credit card info.
Cest la vie.
- A.P.
--
"One World, one Web, one Program" - Microsoft promotional ad
"Remember when the U.S. had a drug problem, and then we declared a War On Drugs, and now you can't buy drugs anymore?"
I object strongly to the lack of content for parrots on your site. I myself feel that (pieces of eight!) content for parrots on you service tends towards the token (polly want a cracker!) spouting of stereotypical (it is no more!) garbage and inane humourous sketches (it has shuffled off this mortal coil!) designed to elicit cheap laughs from the lowest common denominator (show us yer knickers!) which reads this excuse for a site.
Yours most sincerely,
Kevin Phillips *Bong*
There is no right to silence in UK.
dave
I see a misunderstanding in several of the comments here. The bill has not yet passed, and is not yet made law. It is, as yet, still legal to store encrypted data on our computers. But the bill has been drawn up, and it will be debated in parliament, and in the current social climate, is likely to be passed without a murmur. So it is of the utmost urgency that we write, calmly and sensibly, to our MPs to stress the unfairness, unfeasibility, and sheer stupidity of the bill as it presently stands.
That's the kicker. You have to *prove* you have no/there is no key to the data. Or else you are legally determined to be hiding the key.
Open Source. Closed Minds. We are Slashdot.
Will somone please fix the damn Extrans posting mode!
Will ucblockhead please figure out how the damn Extrans posting mode works!
(Oh, and try using "Preview", too.)
The posting modes are tricky, but here's how they work, near as I can tell:
Extrans (Extended Translation) converts everything, including automatically replacing angle brackets with "<" or ">" escapes, so that it all shows up exactly as you type it and nothing gets interpreted as HTML tags.
HTML Formatted is the opposite: it doesn't interfere with what you type, so any tags are interpreted as HTML, and there is no formatting except for your tags. Note that newlines are ignored, which is why people so often complain that their paragraph breaks got lost.
Plain Old Text (which I use and which is probably the one you want) is in between: despite the (perhaps misleading) name, it does interpret HTML tags, but it also adds some formatting information. Specifically, it adds a <BR> tag wherever it sees a newline, so you get a paragraph break wherever you hit return. As far as I can tell, this is the only thing it adds.
I just now noticed that they seem to have fixed a bug that's been irritating me forever: When I would use "&", "<", or ">" escapes to prevent ampersands or angle brackets from being interpreted, it would work, but each I previewed, the text box would get the interpreted results, so the next time through, they would get eaten. This doesn't seem to happen anymore, though. Maybe now I can go play with my user preferences without having to redo the escapes in my sig (painful).
No offence, right? I see you got it straightened out further down. You'll also see me agreeing with you regarding the actual topic of this thread.
David Gould
David Gould
main(i){putchar(340056100>>(i-1)*5&31|!!(i<6)<< 6)&&main(++i);}