Police Need 90 Days To Crack Hard Drives

Twyko64 writes "The UK police may need 90 days to hold terrorist suspects because it takes that long to crack a suspect's PC hard drive." From the article: "Combining the analysis, the translation and second stage analysis, add inter-country co-operation and interview strategy formation, and from the police point of view, the existing 14 days is inadequate and 90 days doesn't look excessive. Another factor is encryption sophistication. If 256-bit triple-DES or similar techniques are used then decryption could require supercomputer-levels of cracking."

Comments

They're really going to hate it when...

[TWX]

They're really going to hate it when suspects start using steganography. Imagine having to brute-force decrypt, only to then have to search for a particular piece of straw in a haystack...

Illegal not to give the police the key?

[Jamu]

If it's illegal to not provide the police with a key to encrypted data, why can't they just put that person in prison for that crime and decrypt the data at their leisure?

Re:Illegal not to give the police the key?

[dan dan the dna man]

This is an excellent point, it is true it is illegal to withold encryption passphrases etc. from the police if they ask you to surrender them. This is why there is a fight in the UK to stop this 90 day 'hold without evidence' the police and government are pushing. The opposition parties have been making this exact point - just bust them on the lesser charge, sling them into jail on something they've *actually done* rather than something they *may have done* and then use that time to gather the rest of the information. Makes perfect sense to me.

Re:90 days, eh?

[Anonymous Coward]

I hope not. Holding suspects for any amount of time without probable cause is bullshit. A hard drive whose contents is not decipherable (as yet if ever) is not probable cause. It is an unknown. If the police do not have reason to hold an individual aside from a hard drive of unknown content, the police have do not have reason to hold an individual.

Re:Blatantly WRONG (now with formatting!)

[sparr0w]

I think the key to this article is not the piece on encryption, but the piece on inter-county cooperation. In the states, it takes a long time for evidence to be approved by the proper authorities for analysis, just because the people doing the analysis don't want to screw up and have the evidence thrown out in court.

And as easy as it is to make fun of the police's analysis methods, my guess is most slashdotter's don't even know what it's like to process evidence for a case. It's not just "running automated tools" on some suspect's hard drive. It's getting to know the case, knowing what you're looking for and where to look for it. Many times it's the police themselves that are writing these "automated tools", which only present the evidence in a way less technical minded officers assigned to the case can understand. And what happens once you get that evidence? You have to try to fit it into the puzzle of the case. It isn't CSI, where you find some email detailing the crime that's digitially signed and the suspect confesses to writing it. Often times its finding some random piece of partially-overwritten text and having to see if it fits into the overall case.

And yes, most digital forensic labs can analyze your precious reiserfs/ext2/ext3/whatever file systems. In fact, I've never run across a lab that couldn't. So don't think you're 1337 linux system will be safe if it's ever involved in a crime. And if they don't have the tools to analyze them, they'll contact a department that does. That's how the real world of forensics works.

Next time you want to talk about a subject you blatently don't understand, do us all a favor and don't hit the submit button.

Re:90 days, eh?

[Don_dumb]

Mod that comment up
If they don't have enough proof to charge someone after even a couple of days, why are they so sure someone is a suspect at all?
They must have some reason to arrest someone in the first place and I sincerely hope that reason is based on a collection of very compelling evidence. At which point they can charge him/her and have as much time as they want anyway.