Slashdot Mirror
British Police Demand Access To Encryption Keys
flip-flop writes "In the wake of recent terrorist attacks, police here in the UK have asked for sweeping new powers they claim will help them counter the threat. Among these is making it a criminal offense for people to refuse disclosing their encryption keys when the police want to access someone's files." From the article: "The most controversial of the police proposals is the demand to be able to hold without charge a terrorist suspect for three months instead of 14 days. An Acpo spokesman said the complexity and scale of counter-terrorist operations means the 14-day maximum is often insufficient."
Innocent until proven guilty. Although that statement is ignored just as often in the US as it is in England, laws that we pass try to at least give the impression that we respect it. So, here is how things go if this passes...
...Time to get pricing on high speed internet access on the moon I guess. This planet's done for.
GoodGuy has a friend who is in some domestic trouble and is hiding some of his assets in off-shore accounts. He keeps his friends account information in an encrypted folder on his computer because his friend doesn't want to lose it and trusts him.
EvilAgentMan thinks GoodGuy is a terrorist planning on taking over the world, due to his recent purchase of a salt water aquarium, baby sharks, laser pointers and duct tape. He charges GoodGuy as being a EvilDoer(TM) and puts him in jail. While looking for evidence, he notices an encrypted folder on GoodGuy's computer. He tells GoodGuy that he must hand over his encryption keys or be charged with the crime of not handing over his encryption keys. He must decide on going to jail for something he is completely innocent of, or releasing potentially incriminating evidence on his friend.
Karma: SELECT `karma` FROM `users` WHERE `userid`=138474;
Sure, you can have my encryption key. Here it is:
01100110 01110101 01100011 01101011 00100000 01101111 01100110 01100110
"Simplify, simplify, simplify!" Thoreau
"I forgot it." Seriously. This is what we do in the U.S., and even if they hold you in contempt-- it's a darn sight better than letting them have access, and seeing what you were up to.
Fortunately we have things like StegFS. But I really shouldn't be disclosing such information, some people in the govA*$%#)D$@#$NO CARRIER
"Innocent until proven guilty. Although that statement is ignored just as often in the US as it is in England, laws that we pass try to at least give the impression that we respect it."
umm, Guantanamo Bay?
I was pretty sure that the regulation of investigatory powers act (1998?) already made it an offense to refuse to disclose an encryption key?
"XML is like violence. If it doesn't solve your problem, use more." - Anonymous Coward
The real measure of a free, open and just society is how it behaves in bad times - not in good times. When difficulties arise and the authorities want sweeping powers to 'protect' the citizens, should the citizens give up important civil liberties for what is probably just an illusion of safety? When are you ever safe enough in these times? Maybe the citizens should stop and ask themselves how much they really value their civil liberties - just how far should you go? Maybe the citizens should not crow too loudly about how free, open and just their society is when they look back at how their country has behaved in difficult times..
I'm waiting for the suit against the UK by the US claiming ashcroft is violating his non-competition clause...
VLC FOR MAC IS DYING! IF YOU DEVELOP, PLEASE SAVE IT!!
Among these is making it a criminal offense for people to refuse disclosing their encryption keys when the police want to access someone's files.
I'm not familiar with British law, but I do know American law is based on the same doctorines as the British(from a historical perspective at least).
In the U.S. the court can order you to provide encryption keys and if you do not you will be held in contempt of the court. This usually means the judge puts you in jail until you decide to provide the keys. To me(IANAL) it seems like the above just formalises the practice. Via the wikipedia reference it appears as though the U.S. did this in 1981.
Being held in contempt of the court is a very normal tool for judges to use with uncooperative court subjects, cryptographic keys aren't special or different.
- "Never let a computer tell me shit." - DelTron Zero
I use CSS encryption for all my privacy needs. I'm sorry, but I'm afraid that it would be illegal for me to provide you the software code that breaks it.
Uniting the Kingdom by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism
Public use of any portable music system is a virtually guaranteed indicator of sociopathic tendencies. -- Zoso
What is the difference between the right to prevent self-incrimination (i.e. the right to silence) and the right to not say your password?
In England and Wales, "a defendant cannot be convicted solely due to their silence" yet this is saying precisely the opposite.
They want encryption keys, but I dare say that not ONE of the investigators (or government officials) can point to a single connection between the recent stuff in London and encrypted information. They keep demanding solutions to problems that don't exist - that's why this stuff keeps happening. If they'd try to solve the problems that DO exist, they might get somehwere- WITHOUT becoming a police state.
If you don't comply with a subpoena, you go to jail for contempt of court. Of course a subpoena actually requires judicial approval, whereas a police request for encryption keys does not.
Terrorist style attacks even happen in police states. Obviously, it impossible to lock things down far enough to give real security, therefore, there is no reason to destroy privacy in a vain attempt to get there.
Necessity is the mother of invention.
Laziness is the father.
Be afraid. Be very afraid. Be British and very very very very very afraid:
Noam Chomsky
The western world is in its worst decadence since the Medieval times...
Yam, yam, uga booga, yam, yam, yade, yade, uga booga, yam, yam, yade, yade
The opinions stated herein do not necessarily represent those of anybody at all. Deal with it.
And how exactly would you know this?
From the PGP FAQ:
Sure it is unlikely, but unless you have some way of proving what you say, it would be unwise to believe that no one can / will in the near future be able to crack or intercept your encrypted messages.For bonus points, see if you can get the file onto the hard drive of some politician you hate.
"When difficulties arise and the authorities want sweeping powers to 'protect' the citizens, should the citizens give up important civil liberties for what is probably just an illusion of safety? When are you ever safe enough in these times? Maybe the citizens should stop and ask themselves how much they really value their civil liberties - just how far should you go?"
You don't have liberty without security, so what's the point of talking about preserving all your civil liberties when you're not free anyway? In reality compromises must be made to maximise freedom.
Vote for Pedro
I'm going to let you in on a deep, dark, dirty secret. They aren't really trying to solve the problem. Terrorism is a boon to the US and UK governments, because it gives them an excuse to push the respective nations closer to a police state.
A police state is not a consequence of misguided attempts at preventing terrorism, but is instead an end being achieved under the cover of fighting terrorism.
Remember, Terrorism is an end to a means for the terrorists, and the governments "fighting" it.
Think the war in Iraq was about Sept 11 or WMD? Think again. It was because defense contractors have well placed connections. For corporations, your life is only worth what they can get out of it. If they can sell military ordinance by getting your children killed in Iraq, so be it. Their gods are money and power, not the ones your Priest, Rabbi, Cleric, Circle Leader or anything else are telling you about. If you think I'm being paranoid, just look up corporate environmental management. Hell, just look up what Coca-Cola is doing in India.
Human life is just another natural resource for corporations. Nothing more.
"Live Free or Die." Don't like it? Then keep out of the USA
Obviously what is needed is a method for dual encrypted files. Basically an encryption/steganography combo. When unencrypted with the 'fake' key, you just get whatever text you encrypted with that key - something uninteresting like expired credit card numbers or letters to grandma and it looks like you have complied with the order. Meanwhile the real key unlocks the data you want to keep secret.
Naturally the algorithms would require that it would be undetectable that this is what you have done.
Some alarm systems have something similar. When you open the business you use the real code. When the robber forces you to open up at gunpoint you use the fake code. The alarm does turn off as expected but it also calls the police with an "under duress" alarm.
~~~~~~~
"You are not remembered for doing what is expected of you." - Atul Chitnis
too bad I am dsylecxic my seepling is just aufful.
hire is thee key
the pass code is "My hovercraft is full of eels."
RSA key mynipplesexplodewithdelight
here is a little test message;
Ya! Ya! Ya! Ya! Do you waaaaant...do you waaaaaant...to come back to my place, bouncy bouncy? If I said you had a beautiful body, would you hold it against me? I...I am no longer infected.
Sorry about the writing. Robot fingers, you know? Cliff Steele in DOOM PATROL #23
Then, if somebody demands/coerces the key from you, you can simply provide one of the alternate keys, which decrypts the cipertext to reveal an innocuous message.
Obviously the system would have to be designed such that it would be impossible to detect how many messages are simultaneously encoded, and no way to determine any one key using knowledge of any of the other keys. But it might be mathematically possible.
Has any work been done on this?
First they came for the catholics,
and I said nothing because I wasn't catholic
Then they came for the witches,
and I said nothing because I'm not a witch
Next they came for the jews,
and I said nothing because I'm not jewish
Now they've come for me,
and there is no one left to say anything for me.
-- If we don't stand up for our rights, now, there will be no right to stand up for them later.
The Americans didn't do much protecting / defending until after _their_ home _was_ attacked.
After which they went chasing the culprits round the world with as much military force as they could.
WWII or war on terror - take your pick. Not to diminish the importance, but in both cases America only got involved because it was directly provoked, not because of some altruistic / noble motive.
Right. I remember when Iraq attacked the U.S. I was scared to death.
Hijackers on 9/11/2001 were mostly from *SAUDI ARABIA*. Bin Ladin attracts newcommers to his cause mainly by expressing a distaste for U.S. presence in *SAUDI ARABIA*.
We invaded Afghanistan, spent 4 or 5 months there, and basically pulled out. Then we, for no justifiable reason, invaded a soverign nation and deposed the elected head of state.
Yes, we were provoked. But, it's time to ask the two critical questions:
1.) Are we attacking the right people?
2.) Why did they attack us in the first place?
Understanding the enemy is the first step to defeating him.
sig?
It was.