Police Need 90 Days To Crack Hard Drives

Twyko64 writes "The UK police may need 90 days to hold terrorist suspects because it takes that long to crack a suspect's PC hard drive." From the article: "Combining the analysis, the translation and second stage analysis, add inter-country co-operation and interview strategy formation, and from the police point of view, the existing 14 days is inadequate and 90 days doesn't look excessive. Another factor is encryption sophistication. If 256-bit triple-DES or similar techniques are used then decryption could require supercomputer-levels of cracking."

Comments

90 days, eh?

[BushCheney08]

Nothing for you to see here. Please move along.

Hmmmm. Guess I'll come back in 90 days for the dupe...

Re:90 days, eh?

[Anonymous Coward]

I hope not. Holding suspects for any amount of time without probable cause is bullshit. A hard drive whose contents is not decipherable (as yet if ever) is not probable cause. It is an unknown. If the police do not have reason to hold an individual aside from a hard drive of unknown content, the police have do not have reason to hold an individual.

Re:90 days, eh?

[Don_dumb]

Mod that comment up
If they don't have enough proof to charge someone after even a couple of days, why are they so sure someone is a suspect at all?
They must have some reason to arrest someone in the first place and I sincerely hope that reason is based on a collection of very compelling evidence. At which point they can charge him/her and have as much time as they want anyway.

Re:90 days, eh?

[kilodelta]

Encrypting a drive is enough for probable cause.

In the twisted logic of the law enforcement game, pretty much anything can be used as PC.

Put it this way, when I worked for the state AG's office all we'd need is the slightest whif and the next thing you know we would be hauling out paper records and computers, servers, etc.

And in the U.S. we have secret courts that will issue warrants with virtually no burden of proof. How do you like those apples?

Re:90 days, eh?

[networkBoy]

"And in the U.S. we have secret courts that will issue warrants with virtually no burden of proof."

No we don't, they issue warrents right out in the open :P
(sad but true, due to the lack of public scrutiny, they might as well be secret)
-nB

Re:90 days, eh?

[mikerich]

I sometimes wonder if the evidence is along the lines of 'looking foreign with possession of, or intent to grow, a beard'. From The Daily Telegraph (27/01/05):

That police activity has been considerable. Since September 11, 2001 to the end of last year, 701 people have been arrested under the Terrorism Act 2000, which requires only "reasonable suspicion" to arrest. Most have come from various branches of the Muslim community - either North Africans, who were the subject of most arrests in the immediate post-September 11 period, and Middle Eastern Muslims, or British-born suspects of Pakistani origin.

However, only 119 of those arrested were charged under the Act. Of those, 45 were also charged with offences under other legislation. A total of 135 others were charged under other legislation, including charges for "terrorist offences that are already covered in general criminal law such as grievous bodily harm and use of firearms or explosives". There have also been a number of fraud cases.

Of the rest, about 60 were transferred to immigration authorities and 351 were released without charge. Only 17 individuals have been convicted of offences under the Terrorism Act and there have been "lesser" convictions, either Irish-related or as a result of membership of proscribed terror groups.

There have been no convictions of alleged Islamic fundamentalist terrorists for the kind of readily understandable "direct" terrorist offences, such as bombings, shootings or possession of explosives and guns, which characterised the years when the Provisional IRA attacked the mainland.

Re:90 days, eh?

[dswan69]

I do think they should pay full compensation if nothing comes of their investigation. A detained person can't work, and will quite probably also lose their job. Given the police force's tendency towards extreme paranoia and abuse of power, especially when given sweeping powers, the government must be willing to pay up, and pay up big, anytime they make a mistake.

Maybe we should start differential taxation - if you support extended imprisonment without trial and excessive police powers because you think it will make you safer, then you must also be willing to pay extra for it. I don't want my taxes wasted on this game of idiots.

Re:90 days, eh?

[Irish_Samurai]

Yeah, what the hell is that?

Everyone hates us Irish until it comes time to pretend your Irish and drink green beer on St. Patrick's day, especially here in America.

Want proof?

"Paddywagon", hows that. If any other nationality or group was inserted into that term there would be a fucking riot.

Totally OT, but I hate this type of shit.

Re:90 days, eh?

[Rac3r5]

this is not entirely true...

after 9/11 there were reports of South Asian Canadians being held in US jails on suspicion..
later on they were released because they were cleared off all charges, but they fact is that they were still held for quite a long time without any charge or evidence.

Re:90 days, eh?

[Anonymous Coward]

As you say, these people have been arrested but not charged. The relevant point is that people should not be arrested without charge. For anyone who hasn't really considered it, 90 days is a long time and for anyone who has never been in prison, I would suggest it works on a similar principle to rape or a violent assault - it is a sudden message from another that they can do what they like to you and you can't stop them. Anyone who has been inside in a proper prison will at least understand where I'm coming from. I don't mean this as a disrespect to rape victims either. Being grabbed off the street and locked in a room, suddenly cut off from your friends and family can be a terrifying experience and the police don't need "torture" to scare you. Just being told you're going down for "terrorism" and they'll take the next fifteen years away from you if they so please? Just a few days can scar you terribly (google for the Stanford Prison Experiment). Ninety days? You don't want to go through that.

And all this, they can do just because they want to. They can do it to scare you, they can do it to punish you and they can do it all without any evidence at all. br

Re:90 days, eh?

[Red Flayer]

TFA states that this is unlikely to go through due to personal liberty issues:

"With the measure unlikely to make it into law thanks to widespread opposition from MPs due to its civil liberty implications..."

Also, this isn't about it taking 90 days to crack a hard drive, decrypt the contents, and translate them... it's about an overload of hard drives needing to be cracked, and the lack of resources to do it in a timely manner.

Also FTA: "Dr Mirza said: "There was a massive backlog of computers to analyse. Some of them couldn't be looked at for over 90 days." It could be just as likely that the police are looking at the controversial extension measures simply because the lack of resources mean terrorist hard drives could be part of a wider queuing system."

This is police FUD, they aren't getting a response to the fact that the people responsible for cracking HDs are overworked, with a serious backlog. This is publicity for adding more staff and beefing the budget. Although the FUD may certainly be valid in this case.

Article should be titled "How Long Does it Take to a Hard Drive to Move Through the Queu in Order to be Analyzed."

Re:90 days, eh?

[Parity]

Err, we have both. The prior poster was referring to the patriot act provisions that allow for closed hearings held in an undisclosed location with an unpublished docket. Supposedly they aren't entirely secret in that they're supposed to reveal what they've done some amount of time after the fact. Unless a motion is granted to keep the information secret for longer do to an investigation still being 'ongoing'...

Of course, that's supposed to be only in case of terrorists, ordinary criminal cases are supposed to be tried in ordinary open courts (although even there, the court can seal entire hearings so all you know is that the police made a motion before a judge at a particular time and place, not anything about the content of the motion. In wiretap warrants, for example, so as not to tip off the person to be spied on.)

Re:90 days, eh?

[h4rm0ny]

Of course these powers will be misused and overused. They make so many things easier by removing restrictions under which police operate and lessening the consequences of their actions. But I keep thinking of the following quote:

A policeman's job is only easy in a police state. - Mike Vargas, in "Touch of Evil" by Orson Welles br

Re:90 days, eh?

[h4rm0ny]

The thing that did my head in in the USA, were all the people who were convinced they're Irish. I'd get some guy there tell me in a pure american accent that he was Irish american? How are you Irish, mate? Were you born there? Do you have an Irish accent? Citizenship? Read Ulysseses? What?

In fact I met almost no actual americans, only hyphenated americans. When someone found I was from Europe, she introduced herself to me as a German-American. So I started talking in German to her and she didn't understand a bloody word. But she said her "Grandad would understand it." I met a guy over there from Mozambique. He said the thing that annoyed him most were people who said they were african-american. It pissed him off because they didn't know a damn thing about africa. It makes NO SENSE! If you're born and raised in America, you're american. Culture is not transmitted genetically and nothing that is makes a bit of difference to who you are.

So if the parent poster is born and raised in Ireland, then he can continue to rant about discrimination. If he's another hyphenated-american, I'm not interested.

And I'm Welsh, btw, and we're the Irish who couldn't swim. It's like anything else - if you let something bother you, people will use it. If you you're proud of who you are, they can't.

Re:90 days, eh?

[Anonymous Coward]

Yeah, I'm irrationally proud of the geo-political area where my ancestors fucked, too.

Re:90 days, eh?

[keraneuology]

Everyone hates us Irish... "Paddywagon", hows that. If any other nationality or group was inserted into that term

Stop looking for proof that the world hates you. The term paddywagon is one of respect, from the days when most cops were Irish. Paddywagons were driven by the Irish - they weren't carrying them.

And I'm Irish on my paternal great-grandfather's side.

Re:90 days, eh?

[ninjagin]

You've made some good obervations, and I think I can help you a little bit with your confusion about how Americans describe themselves.

There was a time, around the mid-1800s, when Americans would identify themselves as just that -- Americans. This was back in the early days of the republic, and there was still a cultural (and sometimes a real) memory of the war of independence. Self-identification as American was part of the pride.

Now, back then, there were self-identified Americans who were actually born in France or England or Germany. To anyone else, they were French or British or German. Their kids, not having any personal experience of the family-homeland, also identified themselves as Americans, though saying you were British-American or French-American or German-American wasn't really an option, since all American families actually hailed from somewhere else in the past. Assimilation (the melting pot) was a very powerful force for white Americans. In a social sense, blacks of the era simply didn't have the social power to self-identify, and their identity was further stripped by having to take their master's surname. Native Americans (or North American aboriginals, if you prefer that appelation) had their own tribal identification, which still remains to this day.

As you get closer to 1900, there were huge waves of immigrants from all over the world, and these were people who wanted a clean slate. They wanted nothing more than to be assimilated. In some families, the language of the homeland was forbidden. Educational institutions sought to have kids learn and speak english without accent. The pride of the immigrant American at the turn of 1900 buried the notion of self-identification of the homeland. My four great grandfathers and mothers (on both mom and dad's sides) spoke very little english because they came to the country when they were too old for schooling, but their kids (my grandmas and grandpas) all spoke English in the upper-midwestern American accent, and while they could understand some of the old languages and maybe speak and read a bit, they were Americans and identified themselves as such.

Consider, then, the melting pot. By the time it got around to me, the national heritage of my family was Belorussian, Lithuanian, French and Norwegian. I only speak one of those languages, but how could I possibly self-identify with any of those nations? I can't, and I don't, but mustly because I still take some pride in being an American, regardless of how my country seems to be perceived at present.

However, their are groups who have been marginalized over time, who seek to re-enforce their sense of identity to elevate their pride. Some black Americans prefer to align themselves with their African roots. Some Irish-Americans identify themselves that way because they seek a tie to their family heritage that may have been repressed as a part of assimilation. Interestingly, the force of assimilation has decreased in American culture. We're a much more multi-lingual, multi-cultural nation, now, and that's also being reflected in the way certain people self-identify. In America, you are free to identify yourself in any way that you prefer, and that's what people do.

Hope it helps.

Re:90 days, eh?

[Xcott Craver]

And I'm Irish on my paternal great-grandfather's side.

Yeah, and I'm a woman on my grandmother's side.

Xcott

Re:90 days, eh?

[haraldm]

Err - sure. Like in Al Ghureib and Guantanamo, right? Without any possibility of consulting a lawyer, right. Yeeeessss sure. If the U.S. were a constitutional state - OK. But the current government has demonstrated publicly that it doesn't give a shit about constitutional rights or the Geneva convention. If it appears convenient, people are taken to another country where even less shit is given about people's rights. It's not as if we hadn't been there, done that. Strategically, you don't fight a worldwide guerilla organization by staring to control your own citizens electronically.

Re:90 days, eh?

[JonToycrafter]

This is incorrect - wrongful imprisonment compensation is by state. There's a chart available at http://www.pbs.org/wgbh/pages/frontline/shows/burd en/etc/chart.html. It doesn't include federal payouts, which there is a bill under consideration for up to $50,000 a year.

There are other remedies, such as filing suits for false arrest and malicious prosecution, but these carry very high burdens of proof, and are often not successful.

Having been wrongfully jailed for a brief time (only days), I can say that none of this really covers what's necessary. In addition to the expenses associated with imprisonment (lost wages, therapy, etc.), there's also the fact that there's pretty much no way to punish those responsible. Were you brutalized by the police or jailers? Physically coerced into making a confession? I would place bets that the police, prosecutors, and corrections officers will receive little or no punishment. Sadly, the problem goes right to the top - if they were to punish those who gave the orders, several police chiefs, former chiefs, and head wardens in major cities would be in jail.

A friend of mine who was falsely imprisoned for 9 days in Philadelphia still has emotional scars five years later. She won't call the police for anything.

Sorry for ranting - folks are regularly exonerated after years and years of imprisonment, but very few people seem interested in tackling the root of the problem. It's just one of my buttons that gets pressed.

Re:90 days, eh?

[rtb61]

You have also forgotten the fiscal penalty. For a lot of people 90 days of no income could send them broke, losing the house or car etc. This places an enourmous amount of power with the police force, enabling a gross amount of itimidation, considering that 90 days for suspicion against the crimes that could get charged and convicted for and suffer a lessor period of imprisonment or even suffer no imprisonment at all.

It is the virtual handing over to law enforcement the power to blackmail anybody. All that needs to happen for you to be declared a terrorists suspect is for some one to say it and some else to listen, no evidence, no proof, nothing but the words of individual. If they had the slightest bit of sence they would understand how much power they are giving terrorists over innocent people, if you should fail to assisst them in some minor way, should they get caught all they have to do is name you and the authorities will listen (a law that terrorises).

This is a law of the rich versus the poor. Rich lawyer on standby no problem, free in a few hours and if you don't like some one you can arrange for an accusation against them. Poor, enjoy you 90 day conviction for no crime, just for having dared to annoy a wealthy or connected individual.

Re:90 days, eh?

[captnbmoore]

And this is why.

The prison industry in the United States: big business or a new form of slavery?

BY VICKY PELAEZ (Taken from El Diario-La Prensa, New York)

HUMAN rights organizations, as well as political and social ones, are condemning what they are calling a new form of inhumane
exploitation in the United States, where they say a prison population of up to 2 million - mostly Black and Hispanic - are working
for various industries for a pittance. For the tycoons who have invested in the prison industry, it has been like finding a
pot of gold. They don't have to worry about strikes or paying unemployment insurance, vacations or comp time. All of their workers
are full-time, and never arrive late or are absent because of family problems; moreover, if they don't like the pay of 25 cents an
hour and refuse to work, they are locked up in isolation cells.

There are approximately 2 million inmates in state, federal and private prisons throughout the country. According to California Prison
Focus, "no other society in human history has imprisoned so many of its own citizens." The figures show that the United States has
locked up more people than any other country: a half million more than China, which has a population five times greater than the
U.S. Statistics reveal that the United States holds 25% of the world's prison population, but only 5% of the world's people. From
less than 300,000 inmates in 1972, the jail population grew to 2 million by the year 2000. In 1990 it was one million. Ten years ago
there were only five private prisons in the country, with a population of 2,000 inmates; now, there are 100, with 62,000
inmates. It is expected that by the coming decade, the number will hit 360,000, according to reports.

What has happened over the last 10 years? Why are there so many prisoners?

They're really going to hate it when...

[TWX]

They're really going to hate it when suspects start using steganography. Imagine having to brute-force decrypt, only to then have to search for a particular piece of straw in a haystack...

Re:They're really going to hate it when...

[AKAImBatman]

They're really going to hate it when suspects start using steganography.

Generally they try to capture a complete computer containing all the algos used for the steganography. That way they don't have to search for a needle in a haystack.

It's a bit like the code devices of WWII. It was always easier to capture a code machine than try to brute force the code itself.

Re:They're really going to hate it when...

[maxwell demon]

Do it the other way round: Have the encrypted files hidden with steganography. It doesn't hurt if someone sees the images, movies or sound files you've hidden your info in (that's the point of steganography), and since a good encryption looks just like noise, it should be extra hard to detect where files may be hidden (I guess you would have to try to brute-force decrypt the noise of every single file, because it might actually be encrypted, hidden data, and then you may still not find the stuff because it's maybe actually hidden in three files whose noise has to be xored together to get the encrypted data).

Of course that assumes the files you hide your stuff in are otherwise legal :-)

Re:They're really going to hate it when...

[TheLink]

They? You totally miss the main point: the people detained are really going to hate it.

And if people have 500GB of data, or more, does that mean the police are going to want to detain them for even longer?

There are already 500GB drives out there.

Re:They're really going to hate it when...

[TWX]

What if I don't use a programmed algorithm?

The old "manipulate the image in the picture" effect would allow me to hide data in an image, and it could be done to where only modifying the image to specific hue or color adjustments reveals the data. It would be something that someone could memorize, and open files read-only to find, modify in RAM, and never save back to the drive once the message is known. There could be thousands of photos in someone's photo album, and only a few that actually contain data too, so that it's hard to even find the files used, let alone to figure out how they're used.

I could also know that certain letters in a text file based on some derivation of a number sequence for position of the letter or word is the message. Anyone that I'm corresponding with could also know the sequence, but if neither party writes it down then it's much harder. It would also work for storage of sensitive data, and be even better security since there'd be only one person who'd know how to recover it.

The most effective way to hide something or protect something is to ensure that nothing is ever written down about recovering it, ever. If there's no key to find then it's again down to brute force.

Re:They're really going to hate it when...

[Ckwop]

Generally they try to capture a complete computer containing all the algos used for the steganography. That way they don't have to search for a needle in a haystack. It's a bit like the code devices of WWII. It was always easier to capture a code machine than try to brute force the code itself

This is actually wrong. Kirchoff's principle applies as equally to steganography as it does to cryptography; even with completly knowledge of the algorithm it should be computationally infeasible to determine a secret message is implanted in the cover text.

Secure stegangraphy is truly undetectable.

Simon.

Re:They're really going to hate it when...

[Verteiron]

Well, in that case, the USA will ship you off to some country where torture is legal, and CIA operatives will proceed to beat the secrets out of you. Now THAT'S brute force...

Re:They're really going to hate it when...

[Hoi Polloi]

Even Mossad knows that torture is a dead end (no pun intended). Torturing someone will just give you what you want to hear. Competent interrogators use psychology and are far subtler.

Re:They're really going to hate it when...

[Hoi Polloi]

"most image programs use temporary files"

Another good reason for RAM drives

Re:They're really going to hate it when...

[mikerich]

This is such blatant 'the sky is falling!' government propaganda.

Under the Regulation of Investigatory Powers Act it is already an offence not to hand over encryption keys to the police when requested to do so.

If a person is detained, the police could investigate the hard disk and ask for the appropriate keys, if the suspect refuses they could then be charged under RIPA.

They would then be brought in front of a magistrate who would determine if there was a case for refusing bail (if they are truly a threat then bail would be refused) before the case is taken up by the higher courts.

The police could then have all the time they want to crack the disk, my rights would be less infringed than they already are and the police would actually have to work to prove the case for a serious crime.

Re:They're really going to hate it when...

[cortana]

Then you don't know much about cryptogrphy! Do you think DES, RSA, AES, and so on are insecure because the algorithms used are public knowledge? No, the security of a good cipher lies revolves around maintaining the secrecy of the key.

Let us consider hiding some data in an image. Assuming the use of decent steganography techniques, then without knowledge of the key used when hiding the data, it is impossible to know that they are hidden in the image in the first place, let alone retrive them.

If this is not so then an attacker would be able to knock up a quick shell script that scanned every file on the system to detect hidden data--thus making the use of steganography pointless in the first place!

Re:They're really going to hate it when...

[booch]

Great. A post suggesting using torture as a legitimate method of data extraction gets a Funny rating.

Re:They're really going to hate it when...

[iceperson]

yeah. and creating a mirror of the data is much too difficult to be feasible.

Re:They're really going to hate it when...

[networkBoy]

There is no "that's sick and sad, but it's true" mod, so funny it is.
-nB

Re:They're really going to hate it when...

[operagost]

Do you write scripts for "Twenty-four" by any chance?

Re:They're really going to hate it when...

[AKAImBatman]

Then you don't know much about cryptogrphy!

Oh, but I do. Except in Steganography, the extraction algo *IS* the key. Now you can use encryption above and beyond the steganography, but that doesn't make the message any more secure than if you'd sent the encrypted message by itself.

The whole intent of using steganography is to obscure the fact that the message was sent. Once that line of defense is down, you're on to more traditional lines of defense.

If this is not so then an attacker would be able to knock up a quick shell script that scanned every file on the system to detect hidden data--thus making the use of steganography pointless in the first place!

As another fellow pointed out, you can already do that. There are a variety of methods that can be used to detect its use. The key is that there's no way to tell *which* image might be carrying a message among all the images floating around the internet. Now if I capture your computer and find images of cute kittens, I'll start looking for signs that this machine was engaged in steganography. However, if I'm looking at random postings to alt.binaries.cute.kittens, I'm going to have a hard time sorting through the sheer amount of data to find what I'm looking for. For all I know, it may not even exist! That is the *real* quandry that steganography poses.

Re:They're really going to hate it when...

[sconeu]

The only problem is when there really *is* no code. How can you give someone something that doesn't exist?

Example: You're falsely ID'ed by a bad guy, or you're mistaken as a terrorist due to bad luck (see: Paul in 24 Season 4).

So you lose all your toes, and have your genitals fried off, because you *CAN'T* give them what they want. This is why torture is useless.

Re:They're really going to hate it when...

[DavidTC]

the extraction algo *IS* the key

I don't know what you mean by this, but it's not anymore true of steganography than anything else.

The key, in steganography, tells you where and how the data is hidden. The algorythm obviously determine where data is put and gotten from, but it uses the key to figure this out.

Otherwise, the police could obviously just grab the steganography tools and run them on all the stuff.

However, you should encrypt on top of steganography, because of the risk of the people doing the decoding being able to find an unmodified copy of the file, and just XORing them. This is the only way to 'detect its use'..by finding unmodified files.

Which is also why you should 'crappify' whatever you use. If it's a JPEG, open it up, change one pixel in the corner to black, and save it at a slightly higher compression. If it's an MP3, downcode it by 16bps. Make it so no one has exactly whatever you're sticking info into.

Including you. You need to treat the originals like you treat unencrypted images...keep them only in RAM, or wipe them when done.

And, heck, delete the stuff that you degraded them from, too. Otherwise, they could just use whatever tools you used, which are presumably still on your computer, and get exactly the same thing you did. By deleting, you'll make it hard for them to figure out which rip of 'One Week' you degraded to 160k before possibly hiding stuff in it, or if this is an original rip that's simply not that easy to find on P2P networks.

Or you can go in the other direction, and simply use things that no one else could have a copy of, like images from your digital camera.

Re:They're really going to hate it when...

[Dread_ed]

Torture of the kind that you see on TV dosen't work well.

There are other methods that work quite well. For instance: dilating the eyes with drugs, propping the subjects eyes open , and then directing an absurd amount of light into the eyes will break most people down quickly.

There are other methods that can gain the subjects acquiesence with very little mess and few lasting marks (on the outside).

They're morons who deserve to get caught

[Dwonis]

*I* always use at *least* 1024-bit AES!

Re:They're morons who deserve to get caught

[wiggles]

That just means they'll keep you for 50 years without a trial (or however long it takes them to crack your encryption). Interesting that those that use encryption are automatically considered criminals.

Re:They're morons who deserve to get caught

[meringuoid]

Interesting that those that use encryption are automatically considered criminals.

That's because they are criminals. Failure to turn over your encryption key is an offence under the RIP Act, punishable IIRC by up to two years imprisonment.

The innocent, of course, have nothing to hide.

Re:They're morons who deserve to get caught

[ganache]

Where did it say that those using encryption are automatically considered criminals? They're suspected criminals who happen to use strong encryption

Re:They're morons who deserve to get caught

[SirGeek]

I believe that they are also passing a law that makes it a felon to withhold encryption keys on your local hard drive after a warrant have been issued.

Wouldn't that fall under not incriminating ones self ? I mean, why should you be forced to turn evidence over to someone to use against you ?

Re:They're morons who deserve to get caught

[Jugalator]

That's because they are criminals. Failure to turn over your encryption key is an offence under the RIP Act, punishable IIRC by up to two years imprisonment.

I guess that's why one may use TrueCrypt with its support for two-level plausible deniability. I.e. it's practically impossible to prove there isn't more on the encrypted volume than you see, unless you have an enormous time to spend on trying to crack the hidden nested volume.

No such thing as "256-bit triple des"

[Jepler]

the subject says it all .. please replace TFA with one written by a clue-holder.

Re:No such thing as "256-bit triple des"

[Proaxiom]

That should be the tip-off for the uninitiated, in any case. Triple DES has an effective key length of 112 bits. I'm sure they meant 256-bit AES, but it's a good clue that the author has no idea what he's talking about.

Seriously, nobody, including name-your-favourite-government-agency, is brute forcing a 256-bit AES key. Not in 90 days. Not in 90 years. Think about the number 2^256 for a second, and consider the computing power required to do that many operations.

What may be possible in 90 days is brute forcing passwords, which is practical if the perp uses password-based keys. The article doesn't mention that.

It's also possible that the authorities are just exaggerating their capabilities so as to deter pedophiles and what-not. If you can't read people's mail, it's sometimes effective to pretend to be reading people's mail.

Re:No such thing as "256-bit triple des"

[Dachannien]

Seriously, nobody, including name-your-favourite-government-agency, is brute forcing a 256-bit AES key. Not in 90 days. Not in 90 years.

0x00000000 00000000 00000000 00000000 00000000 00000000 00000000 00003039? That's the kind of encryption key an idiot would have on his luggage!

Re:No such thing as "256-bit triple des"

[z-man]

Pssst, like the NSA doesn't have quantum computers behind that triple fence that can brute force 256bit keys in an instant.

Now, shut up and help me find my tinfoil hat.

Re:No such thing as "256-bit triple des"

[maxwell demon]

0x00000000 00000000 00000000 00000000 00000000 00000000 00000000 00003039? That's the kind of encryption key an idiot would have on his luggage!

Good to know. Therefore I'm not an idiot, because mine is
01234567 89ABCDEF 01234567 89ABCDEF 01234567 89ABCDEF 01234567 89ABCDEF 01234567 89ABCDEF. :-)

Re:No such thing as "256-bit triple des"

[dan_bethe]

Ok what about with rainbow tables, vast stores of precomputed hashes? They say that with a 64GB table, it'll take a few minutes to crack any Windows lanmanager password up to 14 characters in size using "all possbile characters on a standard keyboard (not including those alt+xxx characters)" on a standard 666 MHz system. Some individual table sets have been known to reach 600+GB in size. How do the likes of 3DES and AES stand up to that? I'm an encryption noob.

Re:No such thing as "256-bit triple des"

[Proaxiom]

Windows lanman hashes are notoriously weak, tools like rainbowcrack take advantage of that fact to crack the passwords in ridiculously short periods of time (IIRC, weak passwords fall in seconds). Among other issues, the 14 characters are split into two 7-character strings, which are hashed separately. This means finding a long password is equivalent to finding two short passwords: additive complexity rather than multiplicative complexity.

But brute forcing passwords and brute forcing random encryption keys are two totally different balls of wax. When you break passwords, you rely on the fact that there are a limited number of passwords users will use. If you consider how many 8 character passwords you can construct using upper case letters, lower case letters, and numbers, you'll see there are only around 2^48. If you only use English words than the number is far, far lower (less than 2^20). Those are crackable.

If, on the other hand, you use a random 256-bit AES key that is not derived from a password (meaning you have to store it somewhere securely), nobody is going to be able to brute force it.

Re:No such thing as "256-bit triple des"

[archen]

Also, another reason it's easy to set up a table is because Lanman hashes (and NT hashes for that matter) do not use salts. For one password with a 2 character salt creates over 1000 possible hashes for the same password.

Lanman passwords are also case insensitive so you reduce the pool per charcter by 13.

Re:No such thing as "256-bit triple des"

[NelsonM]

0x00000000 00000000 00000000 00000000 00000000 00000000 00000000 00003039? That's amazing! That's the same encryption key I have on my luggage!

Blatantly WRONG

[Work Account]

Most times a police department cannot even ANALYZE data properly if a machine is not running some modern form of Microsoft Windows on an x86 platform.

They have automated TOOLS that go through and find Web browser histories, caches, and cookies.

On machines where users do not run Microsoft Internet Explorer and use Outlook for email, often times departments are SOL.

Re:Blatantly WRONG

[Agelmar]

Assuming this is true (which I find really depressing): On modern versions of Windows (2K/XP Pro) you can enable encryption in the NTFS filesystem. Since I don't run Windows I'm not sure of the specifics (keylengths etc), but I wonder if this would also be too much for departments to handle. Then again, maybe I really don't want to know...

Re:Blatantly WRONG

[XorNand]

The defacto application used by law-enforcement agencies to do these things is EnCase, if anyone is interested. It's major bucks though, and don't expect to be able to download a demo version. ;-)

Re:Blatantly WRONG

[sparr0w]

I think the key to this article is not the piece on encryption, but the piece on inter-county cooperation. In the states, it takes a long time for evidence to be approved by the proper authorities for analysis, just because the people doing the analysis don't want to screw up and have the evidence thrown out in court. And as easy as it is to make fun of the police's analysis methods, my guess is most slashdotter's don't even know what it's like to process evidence for a case. It's not just "running automated tools" on some suspect's hard drive. It's getting to know the case, knowing what you're looking for and where to look for it. Many times it's the police themselves that are writing these "automated tools", which only present the evidence in a way less technical minded officers assigned to the case can understand. And what happens once you get that evidence? You have to try to fit it into the puzzle of the case. It isn't CSI, where you find some email detailing the crime that's digitially signed and the suspect confesses to writing it. Often times its finding some random piece of partially-overwritten text and having to see if it fits into the overall case. And yes, most digital forensic labs can analyze your precious reiserfs/ext2/ext3/whatever file systems. In fact, I've never run across a lab that couldn't. So don't think you're 1337 linux system will be safe if it's ever involved in a crime. And if they don't have the tools to analyze them, they'll contact a department that does. That's how the real world of forensics works. Next time you want to talk about a subject you blatently don't understand, do us all a favor and don't hit the submit button.

Re:Blatantly WRONG

[pegr]

Most times a police department cannot even ANALYZE data properly if a machine is not running some modern form of Microsoft Windows on an x86 platform.
 
While largely correct, the situation changes if you get the attention of the three letter organizations. Of course, if they were on to you, the 90 day thing wouldn't mean anything, as you are more likely to just have your drive imaged and your keyboard bugged. If you got wise to the black bag job, you'd simply disappear...
 
I can understand the 90 day thing actually working, though, because if you didn't rate the attention of the previously mentioned three letter organizations, you're not really that important. Remember, kids, it's not cracking the encryption that gets the bad guys busted; it's poor key management. Keyboard bugs just make it easier...

Re:Blatantly WRONG

[John Betonschaar]

Pretty much true I guess... And it can get even worse, I can tell you.

Last week the police over here in the Netherlands lost 78 email addresses of terrorist suspects, that were found after they arrested the terrorist that murdered Dutch cineast Theo van Gogh. The reason: the emails and email addresses were on a hotmail account that was not used for more than 30 days and deleted by Microsoft!!!. For real. Check for example here (in Dutch)...

What a waste of time...

[tgd]

They should just pin the suspect down and pump five rounds into their head.

Oh wait...

Re:What a waste of time...

[dbolger]

Well, in the case of terror suspects, the information that the detainee holds is far more valuable than convicting the detainee himself - a bomber who might provide links to the larger organisation, for example.

Trying to decode the information held within several thousand lumps of human brain tissue would probably take even longer than 90 days ;)

Re:What a waste of time...

[Rayonic]

They should just pin the suspect down and pump five rounds into their head.

What, you think they'll start talking after 5 rounds of free beer?

Re:What a waste of time...

[sunya]

Except when they shoot the innocent. Id10t.

Illegal not to give the police the key?

[Jamu]

If it's illegal to not provide the police with a key to encrypted data, why can't they just put that person in prison for that crime and decrypt the data at their leisure?

Re:Illegal not to give the police the key?

[dan dan the dna man]

This is an excellent point, it is true it is illegal to withold encryption passphrases etc. from the police if they ask you to surrender them. This is why there is a fight in the UK to stop this 90 day 'hold without evidence' the police and government are pushing. The opposition parties have been making this exact point - just bust them on the lesser charge, sling them into jail on something they've *actually done* rather than something they *may have done* and then use that time to gather the rest of the information. Makes perfect sense to me.

Re:Illegal not to give the police the key?

[Raul654]

I can't speak to the UK, but in the US you are have a right against self incrimination. You have the right to refuse to answer police questions, and (short of being called to testify before a grand jury and being given blanket non-transactional immunity for your testimony) there's really no way to compel a person to talk to the government about anything they don't want to.

Re:Illegal not to give the police the key?

[dan dan the dna man]

Under the "Regulation of Investigatory Powers' (or RIP) bill - failure to disclose the encryption key to something the police believe you have encrypted gets you 2 years in jail...

see here for a good writeup

Re:Illegal not to give the police the key?

[Xugumad]

> If it's illegal to not provide the police with a key to encrypted data
There's a real problem with burden of proof here, in that you now prove you don't have the key to any encrypted data the police demand a key for. This is essentially impossible.

This is particularly an issue if, say, Evil Bob accidentally e-mails his plans for world domination to me. Of course, he's not a fool (except for the inability to use an addressbook, but nevermind), so he's encrypted his plans. I get a freaky looking encrypted e-mail, and delete it assuming it's spam.

Except, it sits there, in my inbox. Now, for some reason, the police then seize my computer. They're sifting through my HD, and find Evil Bob's e-mail sitting in my trash folder, but no key. It's essentially impossible for me to prove I don't have the key for the e-mail, and now have a criminal record and spend the next two years of my life in jail.

256? 3des? no.

[jlcooke]

3des. 3 x des. des uses 64 bit key. Well, 56 bit if you remove the useless parity.

3 x 56 = 168. or 3 x 64 = 192. Either way, 256 is is not.

256 bit AES, then maybe.

What about RIP?

[andrewscraig]

I thought that was why the UK introduced the RIP act (http://www.hmso.gov.uk/acts/acts2000/20000023.htm )? Could they just demand that the person comes up with the keys -- if they don't, hold them through the RIP act and brute-force them, if they do -- then they've either got evidence or the innocent person can go free?

It seems that they are just using this as an excuse to hold someone indefinately?

Re:What about RIP?

[slyguy135]

Yeah, that's pretty much right, especially as that part of the RIPA has not even been used yet (I do wish more people read that blog, by the by).

The arguments the Government is using to try to get this passed are embarrassing. That they seem to be succeeding most of the time is shameful.

I wonder how long it will take...

[JesseL]

for some politician to propose commandeering the unused CPU cycles of the nations PCs, ala distributed.net but mandatory.

Re:I wonder how long it will take...

[diagonalfish]

There should be a mod for "+1, Creepy".

Ninety days?

[SatanicPuppy]

Psssh. That's gotta be a worst case scenario. In my experience, even people who are paranoid enough to encrypt things tend to be careless with their keys. I found one once where the guy had encrypted the hell out of it, and left a copy of the key in the default key gen directory. Some people just throw it in the trash, and then forget to empty the trash, or forget to secure purge it afterward, so the key can be recovered.

For big corporations and places that have enough staff to be able to implement a good crypto policy, I'd be surprised if you COULD crack it in 90 days. 256 isn't anywhere near as high as you could go if you were paranoid, and storing data that you didn't need to read all the time.

And you think they're a terrorist... why?

[jfengel]

The idea is that you're holding them without any charge until you gather the evidence on the hard drive.

I understand that the police will sometimes be unable to completely make a case until they've gathered all the evidence, but it seems that there should be some sort of intermediate level to say, "We have at least some reason to hold this guy."

Perhaps what's needed is a judge to say, "Yeah, you have enough evidence, and the guy presents enough of a flight risk, for me to let you hold him for three months", even if that evidence would be insufficient for a real indictment.

Because right now it sounds like "We're going to lock this guy up for 90 days with absolutely no evidence at all on our say-so."

Re:And you think they're a terrorist... why?

[glesga_kiss]

What's really fucked up is that people like the Guilford Four, also accused of terrorism during a politically sensitive time, we put away on fake evidence compiled by the police who were anxious to get a result. Back then, you were "innocent until proven Irish". Now it's "until proven Islamic". They were tortured for confessions and finger pointing. Sound familiar? Something happening RIGHT NOW?

Computer evidence is next to useless. It is infinitely easier to fake a word doc than it is someones handwriting, DNA and fingerprints that one might find on a piece of paper. I predict that in 10 years, once new forensic techniques for IT data analysis become available, a whole slew of "terrorists" will have their convictions quashed as the polices simply created a few fake emails. This is not tin-foil hat territory, this has happened numerous times in the past.

When will the public wake up? These "detention without trial" laws are something that the authorities have been seeking for decades. Only now do they feel they have the inertia to get them passed.

The definition of terrorism is "using fear to achieve a politcal goal". I wonder who the REAL terrorists are here...?

Slowness

[diagonalfish]

Dr Mirza said: "There was a massive backlog of computers to analyse. Some of them couldn't be looked at for over 90 days."

So basically, the 90-day period is not because that's how long their fancy "supercomputer" needs to crack it, but because they are unable to cope with the number of computers confiscated from their terrorist suspects. Sounds like they need an additional supercomputer.

Thanks for letting us know

[iamacat]

That government can crack triple DES in more than 14 but less than 90 days on their secret supercomputer. No wonder they dropped opposition to crypto exports. The question is, which algorithms/key sizes can we use that is likely still uncrackable?

It's just an excuse.

[Ebirah]

The underlying objective is for the UK to adopt the US model of 'terrorist' detention. Extending the permitted period for detention of 'suspects' without charge to 90 days is a step in the desired direction for this. And as people are saying, 90 days won't be enough time to crack anything that's properly secured. In 90 days, our boys in blue, who don't really get this IT stuff very well, might perhaps be able to crack an UNENCRYPTYED drive. Not all terrorist suspects have hard drives, anyway. I guess they'll have to let the ones who don't go straight away.

Re:It's just an excuse.

[HD Webdev]

our boys in blue, who don't really get this IT stuff very well, might perhaps be able to crack an UNENCRYPTYED drive. Not all terrorist suspects have hard drives, anyway. I guess they'll have to let the ones who don't go straight away.

The National Security Agency is the largest employer of degreed mathematicians in the world. They are not stupid people.

They'll gladly crack encrypted information for allied countries and other US agencies.

These people aren't the Keystone Cops and it's not like a street-level officer will be in charge of decrypting a hard drive.

Re:It's just an excuse.

[3waygeek]

The National Security Agency is the largest employer of degreed mathematicians in the world. They are not stupid people.

Plus, thanks to the little gray men, they're 200 years ahead of the rest of the world in mathematical theory.

That's 90 days without charge...

[Claws Of Doom]

Holding someone for 90 days without charge, then finding their computer hard-drive didn't actually hold any incriminating evidence doesn't look too good. Is there anything that stops them looking at the hard drive after having to release a suspect? IANAL, but if your prima facie evidence is encrypted on a computer, what right have you got to arrest them in the first place?

Re:256bit triple DES

[meringuoid]

Glad to know they think they can crack it in only 90 days with a mere "super-computer".

They can't and don't, but what the hell, it's a pretext. The police have never liked this whole deal of having to let people go if you don't have enough evidence to charge them with anything. The longer they can get to find something that will stick, the more criminals they successfully prosecute and the safer we all are.

Now, if you'll excuse me I have to open my new estate agency, pontine transit solutions a speciality...

With or without specific charges?

[pla]

The UK police may need 90 days to hold terrorist suspects because it takes that long to crack a suspect's PC hard drive

I write this as a 'Merkin, so forgive if I don't fully "get" UK law, but...

At the point where the police would waste 90 days of supercomputer-level CPU power on cracking an encrypted HDD, wouldn't they already have enough other evidence to charge the suspect with an actual crime, and could just ask for that 90 days as a delay before the actual trial?

The idea of the police making people dissapear for three months at a time on a whim scares the hell out of me. Suddenly sarcasm, or wearing the wrong clothes, or "driving while black" becomes punishable by three months in prison? Time to invest in prison/industrial stock...

Re:With or without specific charges?

[lawpoop]

You are writing the above as a pubic hair wig?

256-Bit Triple DES

[John Fulmer]

Another factor is encryption sophistication. If 256-bit triple-DES or similar techniques are used then decryption could require supercomputer-levels of cracking.

Ouch. Technobabble at its worst.

a) Triple DES is 112-bit encryption.

b) If you are using strong encryption, like a 256-bit AES cypher, no number of supercomputers are going to 'crack' it, whether it's 14 or 90 or 900 days, unless it's a really bad implementation.

c) One would HOPE that the police would have evidence before they start impounding things. But this is about 'fishing' for evidence for 'suspected' terrorists. "You look like a terrorist, so we'll impound your things in the hope that we'll find something". So much for presumption of evidence (which I believe holds true in the UK as well.

Things like this make me sad. Just another way for the authorities to 'protect' it's citizens by making that sure they can see all and know all. Welcome to the Panopticon.

Re:256-Bit Triple DES

[slavemowgli]

Triple-DES is 168-bit encryption, or at least if by "x-bit encryption" you mean that the keysize is x bits, which I think is pretty much standard. It's *effectively* 112-bit due to certain known weaknesses, but technically, it's still 168-bit.

Of course, that's really just a technical issue, especially compared to the rather glaring errors ITFA you're pointing out, but I think it's something worth mentioning. :)

Criminalizing Encryption

[venomkid]

...I think we all know what the message is here: Encrypt your personal files, go to jail for 90 days.

More and more, according to law enforcement, encryption is considered only a tool of criminals. There have been a few cases like this in the US where a suspect's use of PGP or other common encryption has been used against him in court, even though no specific evidence was found encrypted.

Comment removed

[account_deleted]

Comment removed based on user account deletion

use Firefox, go directly to GITMO!

[Thud457]

Alternative browsers pose challenge for cybersleuths

You think that they can afford to hire some lunix rocket surgeon as a computer forensics expert on what the local PD pays?

Re:heh.

[maxwell demon]

30 days to figure out how to write "Allah" in arabic.
60 days to figure out how to type an arabic password.

What kind of encryption are YOU using???

[ferrellcat]

"You honor, we are going to have to hold the suspect for 2.154E+E122 years."

Re:The obvious answer

[fbsderr0r]

do you honestly believe someone who knows they've been caught,
and its only a matter of time before all of the evidence will show up,
will actually stay in the country?
yes yes, take away their passports, surely that will stop them...
oh wait, this is /., welcome to the fairytale land.

Re:256? 3des? no.

[l33td00d42]

As someone already pointed out, it's effectively 2 x 56 = 112. "Triple DES" only uses (effectively) two DES keys, so that it would be to be able to talk to "Single DES" applications by giving it two copies of a single DES key. In that case, the three rounds are encryption+decryption+encryption all with the same key, which is equivalent to just encryption.

If the two keys are different, you the encryption phases are encryption + a "wrong" decryption (different key) + encryption again, which is much better than just a single encryption.

Details, of course here.

Re:Blatantly WRONG (now with formatting!)

[sparr0w]

I think the key to this article is not the piece on encryption, but the piece on inter-county cooperation. In the states, it takes a long time for evidence to be approved by the proper authorities for analysis, just because the people doing the analysis don't want to screw up and have the evidence thrown out in court.

And as easy as it is to make fun of the police's analysis methods, my guess is most slashdotter's don't even know what it's like to process evidence for a case. It's not just "running automated tools" on some suspect's hard drive. It's getting to know the case, knowing what you're looking for and where to look for it. Many times it's the police themselves that are writing these "automated tools", which only present the evidence in a way less technical minded officers assigned to the case can understand. And what happens once you get that evidence? You have to try to fit it into the puzzle of the case. It isn't CSI, where you find some email detailing the crime that's digitially signed and the suspect confesses to writing it. Often times its finding some random piece of partially-overwritten text and having to see if it fits into the overall case.

And yes, most digital forensic labs can analyze your precious reiserfs/ext2/ext3/whatever file systems. In fact, I've never run across a lab that couldn't. So don't think you're 1337 linux system will be safe if it's ever involved in a crime. And if they don't have the tools to analyze them, they'll contact a department that does. That's how the real world of forensics works.

Next time you want to talk about a subject you blatently don't understand, do us all a favor and don't hit the submit button.

So does that mean...

[mengel]

That if I use 4096-bit encryption, they'll argue they should be able to hold me for a year, and if I use 8192-bit encryption, for 2 years???

If you extrapolate it to "We get to hold people for as long as it takes to find whatever we're looking for on their hard drive", then they can argue for holding you for 200 years, depending how you might have hidden data on the hard drive.

Re:So does that mean...

[SatanicPuppy]

More like 2 million years. We're talking powers of 2 here, so 512 is not twice as hard to break as 256...257 is twice as hard to break as 256. 512 is 2^256 times as hard to break as 256.

Here's what to do:

[Ihlosi]

1. Encrypt hard drive.
2. Store keyfile in a safe place.
3. Get a defective USB stick. Label "HD KEYFILE" in big red letters. Keep it on the computer desk at all times.
4. Get a 3.5" Floppy. Preferably from pre-1990. Wipe with magnet a couple of times. Label "HD KEYFILE BACKUP" in big red letters. Put on shelf next to computer.
5. Get a blank CD-R. Fill with PR0N. Label "PR0N + HD KEYFILE BACKUP". Mistreat CD-R a little (preferably adding some scratches on the inside. Leave in CD-Rom drive.

In case of arrest:
1. "Um ... you want my password ? If you really want to see my PR0n collection ... it's on the USB stick."
2. "What ?! It doesn't work ? Good thing I have a backup. It's on the floppy disk."
3. "What now ?! It's broken ? Good thing I have another backup of it on the CD with my PR0N colelction ... try that."
4. "The CD doesn't work ? OH NO, ALL MY PR0N is GONE ! AAAAARGH !"

90 days to crack the average joe harddrive?

[Mr.Fork]

It's common practice for a local Blockbuster employee making $8 a hour, to have their personal hard drive computer secure with a $2000 piece of software that requires expertise to use and 90 days for a federal security agency to crack, isn't it?

If you're an average Joe, Hussar, Muhammad, John, Mary, Xi, Pieter, you drive a taxi for a living, or are a student, or you own a small convenience store, and arrested for suspicious activities, but your hard drive is encrypted with an expensive 256bit encryption software, maybe, just maybe, (a personal hunch) there is something you're hiding. Maybe.

Myself, a 25 year IT veteran, Federal Government manager, plus a dozen years experience military service in communications and electronics, my hard drive is wide open.

But then again, perhaps I'm being paranoid...or the 90 days are justified. As the saying goes, if you've got nothing to hide...

Hold them as long as it takes is my opinion, or they decrypt the hard drive for the investigators, which if they had nothing to hide, would mean they would get out in a few days.

Re:90 days to crack the average joe harddrive?

[gg3po]

Hold them as long as it takes is my opinion, or they decrypt the hard drive for the investigators, which if they had nothing to hide, would mean they would get out in a few days.

The "if-you've-got-nothing-to-hide" argument is very short-sighted. Sometimes you do have something to hide, and for good reason.

Here's a short list of legitamate reasons for anonymity I once found somewhere. Sorry I can't credit the original author, you know who you are:

• Secret Ballots. Otherwise a sufficiently motivated group could bully voters who previously voted for another party.
• The battered wife (or husband for that matter) that doesn't want to be tracked down.
• The whistleblower that wants to be able to let the authorities know that his or her organization is doing something illegal, but doesn't want their life destroyed by doing so.
• The ex-con that served his time and paid for his crime, and only wants a job.
• The journalist that has sources to protect. One of the most famous in history: "deep throat".
• Important historical documents were sometimes posted anonymously, great literature has been written anonymously or under psuedonyms to protect the author who may have been living under an oppressive political environment.

The Federalist papers were published under the pseudonym "Publius", and several of the U.S. Founders had to publish pre-revolution political treatises anonymously for their own protection. Voltaire said It's dangerous to be right when the government is wrong. I would advise you to turn off the TV and pick up some history books. I mean no disrespect, just to give you some helpful advice.

For those in the U.S., here are some other good reasons [emphasis mine, of course]:

Amendment IV

The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no warrants shall issue, but upon probable cause, supported by oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.

Amendment V

No person shall be held to answer for a capital, or otherwise infamous crime, unless on a presentment or indictment of a grand jury, except in cases arising in the land or naval forces, or in the militia, when in actual service in time of war or public danger; nor shall any person be subject for the same offense to be twice put in jeopardy of life or limb; nor shall be compelled in any criminal case to be a witness against himself, nor be deprived of life, liberty, or property, without due process of law; nor shall private property be taken for public use, without just compensation.

Amendment VI

In all criminal prosecutions, the accused shall enjoy the right to a speedy and public trial, by an impartial jury of the state and district wherein the crime shall have been committed, which district shall have been previously ascertained by law, and to be informed of the nature and cause of the accusation; to be confronted with the witnesses against him; to have compulsory process for obtaining witnesses in his favor, and to have the assistance of counsel for his defense.

Don't use one time pads

[Catamaran]

You could be locked up forever!

90 days == 6 month jail sentence.

[caluml]

Shami Chakrabati from Liberty made a very valid point. Holding someone for the equivalent of a typical 6 month jail sentence with no charge is a very good way to alienate that person and his/her community. How would we feel about losing 3 months of our lives, and after that, being released with "no charge". What would our employers think? What would happen to our houses, mortgages during that time? It's easy to think "90 days isn't so much", but think about what it actually means. Shami is great.

Re:90 days == 6 month jail sentence.

[Maljin Jolt]

How would we feel about losing 3 months of our lives, and after that, being released with "no charge". What would our employers think? What would happen to our houses, mortgages during that time? It's easy to think "90 days isn't so much", but think about what it actually means.

This is probably the original intention of the law setup: to destroy your life completely without legal consequences. I remember well that schema from totalitarian communist regime I lived in for more than 20 years. Pure possibility of it could happen makes majority of people behave conformly.

Re:90 days == 6 month jail sentence.

[hackstraw]

How would we feel about losing 3 months of our lives, and after that, being released with "no charge". What would our employers think? What would happen to our houses, mortgages during that time?

But we are talking about terrorists here, not normal people like you and I.

Yet.

Why am I being terrorized by the government's reaction of terrorism?

I can't speak for England, but someone suspected of a crime, should be formally and specifically charged with the approval of a 3rd party (judge) via a warrant.

Its a decent system. I've never heard of a judge that would say, "So, you have information that this guy is trying to bomb a bunch of innocent people?" No warrant for you, go bust speeders.

Give me a break. These people are (hopefully) being detained from some kind of evidence. Its not intuition or because they don't like you is it?

Get evidence, get a warrant, charge them with a crime, take them to court.

Its worked fine for hundreds of years (pretty much).

Its much better than get maybe evidence, put them in jail until more and better evidence comes my way.

Re:90 days == 6 month jail sentence.

[imthesponge]

"But we are talking about terrorists here, not normal people like you and I."

They can arrest you or I as a "terrorist" just as easily. If people don't acknowledge that, then they assume that accusation = guilt and they say "But they're terrorists! They're not humans like us! You don't want people to die, do you?"

I agree with you entirely, though.

Advanced Decryption? Advance Encryption!

[woodsrunner]

it has long been suspected that the NSA doesn't approve any encryption that they don't have the ability to break in some reasonable time frame...

This is definitely plausible if you believe in the rumoured quantum encryption and a few other such concepts. But I believe it was one of Phil Zimmerman's reasonings to release PGP, or at least a meme that developed from its release, that the more stuff that is encrypted the less effective decrypting becomes since even with advanced techniques it will still be too difficult to decrypt everything if everything is ecrypted.

If you not only incrypted important documents, but every file from your mp3's on up and also ran a program that randomly generates encrypted noise files so a harddrive has maybe 10 critical documents and 500,000 noise documents -- it would be sort of like throwing your shredded documents into the compost bin.

With this methodology, even if a file could be cracked in ten minutes, your still looking at over 9 years of work to find 10 documents. And say the files could be cracked in 30 seconds each you are still looking at 6 months of work and then however long it would take to analyze the noise from signal.

In the end, however, this sort of tactic would probably give a court a valid reason under this ruling to keep you locked up for a long time without any real evidence. Not like this isn't happening already. In the end it would sort of be a reverse tactic of wounding, not killing, the enemy -- the more techs that are busy trying to decode garbage and take care of pawns in jail the less enemy you have to deal with. And if people are willing to blow themselves up for a cause, I think it wouldn't be to hard to get volunteers for this sort of occupation.

Supercomputer-levels of cracking?

[xquark]

Why don't they just crack the bones of the person being held, I'm sure that
would make all their other related cracking requirments go that little be faster
if you know what I mean... :)

Arash

I can crack my harddrive in a split second....

[Been on TV]

I can crack my harddrive in a split second by using a sledge hammer.

Not quite the case

[twem2]

The police want to be able to detain terrorist suspects for 90 days without charge. This is probably a figure they pulled out of the air as a good starting point for negotiations, however Tony Blair has decided that whatever the police want they should get when the magic word is mentioned.

One of the justifications was that they need that long to decrypt and analyse data. In which case, it is already a crime not to hand over a password of encryption key when requested so you can get them in custody on that charge for that long.

The arguments for the 90 days are incoherent, but that's what we have grown to expect from our government, especially when it comes to civil liberties and/or technology.

Re:256? 3des? no. (not exactly)

[Dr. Blue]

No, that's not right. I think you're probably confused with the argument that Double-DES doesn't appreciably increase security -- because of a meet-in-the-middle attack, known plaintext attacks on Double-DES have complexity 2^56+2^56. That's why you never hear of "Double-DES" -- there's really no point. However, that's not true with Triple-DES, which is why it is used. As some other posters have pointed out, the complexity of breaking 3DES is around 2^112. That's unbreakable by a brute force attack using any conceivable technology. Your linear combination of complexities would be pretty easily breakable using something like the EFF's Deep Crack machine.

Plausible deniability...

[tjwhaynes]

Under the Regulation of Investigatory Powers Act it is already an offence not to hand over encryption keys to the police when requested to do so. If a person is detained, the police could investigate the hard disk and ask for the appropriate keys, if the suspect refuses they could then be charged under RIPA.

So then you need a method of being able to hide precisely what is encrypted and what is not. Look around and you'll find systems for filling a file system with chaff files to make finding the real data more interesting. One I looked at ended up with a filesystem with all the files apparently the same size, with constantly changing timestamps and all apparently contain random data. This system then allowed you to apply keys to make certain files readable while leaving the rest as noise. The point of this is that even the empty file system is full of rubbish files. It is impossible to tell (without the complete set of keys) precisely what is really data and what is just generated chaff. This gives you a lever of plausible deniability - if you are asked for the keys to the repository, you can hand over the keys and let them at it. It would be difficult (never say never) to correctly identify encrypted files amongst the chaff which were not covered by the keys provided.

Cheers,
Toby Haynes

Re:Plausible deniability...

[mikerich]

Nice idea!

It's well worth remembering when discussing any aspect of British IT law that the present administration is headed by a man who was incapable of buying flowers for his wife over the Internet, what hope have they of understanding cryptography?

Re:256? 3des? no.

[stedo]

Close, but not quite.

Des uses 64-bit, really 56-bit. Correct

3Des uses 128-bit, really 112-bit. It's named 3DES because it does 3 DES encryptions with two separate keys (actually encrypt1-decrypt2-encrypt1). Doing it the obvious (enc1,enc2) way is insecure and can be broken in 2^56 steps (one keysearch) if you have a really big amount of memory, so it does EDE. The D part is there so that you can set E1 equal to E2 and use the same subroutines for 3DES and DES.

256-bit anything cannot be brute forced. Brute force requires that you iterate through every possible key. Now, according to thermodynamics, it takes kT energy to set or clear a bit, where k is Boltzmann's constant and T is the ambient temperature of the system. The coldest you can run it at is 2.3Kelvin (the ambient temperature of the universe). Any colder, and you need more energy to run a heat sink. So, merely to iterate a 256-bit counter through all it's values (never mind actually using an encryption algorithm) requires (2.3)x(2^256)x(k), which is a lot more energy than could be gained by blowing up the Sun in a nuclear reactor and converting it all to energy. So, no cracking of 256-bit keys.

Crappy passwords are another thing, though

No, torture is useless because

[Aexia]

So you lose all your toes, and have your genitals fried off, because you *CAN'T* give them what they want. This is why torture is useless.

After all that, you *do* give them what they want... a confession and lots of information.

Sure, it's crap you made up in a delirium that'll waste hundreds of hours of valuable time that would be better spent going after actual criminals. But the White House parrots will claim this proves torture "works" anyways.

Two million years

[jd]

Is hopelessly optimistic. Let us say you had a processor capable of a billion (2^30, not 10^9) operations per second and that you've hard-coded the processor such that you can try one key in one operation. You can now break a key of 30 bits in 1 second. Let us also say you've built a large grid computer with 1024 nodes in it, so you can do one trillion (2^40) keys per second.

Such a computer can break an ordinary (56-bit) DES key in 18 hours, 12 minutes and 16 seconds at worst. The average time to break a DES key on such a machine would be 9 hours, 6 minutes and 8 seconds.

To break a 128-bit key would require the computer to run for 2^88 seconds, or 9,813,705,283,528,192,184 years.

Sgt. Wintertons Police Diary

[sikandril]

Day 1: Brought in suspects' computer. For the darndest reason it wouldn't turn on so Sgt. Morris and I went on a 2 hour coffee break. Upon return discovered that computer wasn't plugged in. It was getting late so stamped card and went home. Day 2: Sgt. Morris (who is more experienced than me) put the cd we use for scanning into the suspect's computer but it wouldn't load, no matter what we did. Went on 1.5 hour coffee break. Returned and eventually found out CD was inserted in upside down. Was late so stamped card and went home. Day 3: Managed to 'hack' into suspects' computer! Found suspect's 'dirty stuff' folder, and scanned it by hand for security reasons. After 4 hours was exhausted so called it a day and signed off early. (Note to self: Inquire about purchasing cat's outfit for Mrs. Winterton) Day 4: Suspect seems to have had an affection for fight games (note to self: Add "psychotic tendencies" to suspects portfolio). Played some 'Mortale Kombatt' against Sgt. Morris, who managed to beat me numerous amount of times, adding insult to injury by 'finishing me' in several gruesome ways. Ate sandwich, stamped card and went home. Day 5: Finally beat Morris at Mortal Kombat! Now we're getting somewhere! .......

Canadian Evidence Act

[nightwing2000]

In Canada, where the US Constitution does not apply (yet), we have the Canada Evidence Act. You have no right against self incrimination when called to testify in a trial, but that evidence and fruit of that evidence cannot be used against you - except for perjury.

(You do not have to testify in your own trial -just, if called on to testify against someone else, you must talk.)

Obviously, you are then at the mercy of the judges who decide if the evidence presented at your own trial actually followed from that testimony. And, you don't have to talk to the cops.... AFAIK, it's still not obstruction unless you withhold physical evidence or actually mislead the police.

However, "Lord" Black of Hollinger Inc. fame is arguing that his testimony should not be compelled in a Canadian court because American justice officials can then take it and attempt to extradite him to the USA to stand trial for nefarious conspiracies. (The Canadian evidence rules don't prevent foreigners from using the info, I guess - American, Syrian, or Egyptian...) Still waiting for the decision on that one, but the general attitude seems to be "we don't care about your USA problems..."

Oh great so know they've got a workaround.

[TractorBarry]

Marvellous. So here's how "the bad guys" (tm) will fool the coppers.

1 Buy computer with big hard drive.
2 Get geek to store loads of "nonsense" data encrypted with as strong a key as possible (i.e. shopping lists, lists of birthdays, stuff from encyclopedias)
3 Store "bad stuff" (tm) in head only.
4 Get arrested, claim you "were wondering what all those junk files were" and wait 90 days whilst the forensics bods decrypt the useless data.
5 Get let out.
6 Profit !

(yes I admit it this is a piss poor version of the Slashdot "profit" post :)

Re:NTFS encryption is bollocks

[JKR]

...login password. Which, as other posters have pointed out, can be cracked in a matter of minutes using a precomputed hash table

Only if LANMAN hashes are available, which hasn't been necessary for about 4 years. Also, syskey allows encryption of the master EFS key with a further encryption key which can be stored on removeable media. It's still possible to brute force, but that's not exactly a matter of minutes.

Jon.

The IRA *were* terrorists, after all

[billstewart]

The issue here isn't just English cops beating up Irish due to prejudice. It's Irish as in the IRA and other Irish terrorist groups, and how the current British Government is saying they need all sorts of extraordinary powers to violate civil liberties because Muslim Terrorists are an extraordinary menace unlike anything they've ever had to fight before, powers far beyond what they needed to deal with IRA terrorists. After all, Muslim Terrorists believe in a Different Scary Religion, and are immigrants from countries which the British Government fscked over and they're Really Mad About It, and you can't tell South Asian Terrorist Immigrants or Terrorist Illegal Border Crossers from regular law-abiding South Asian Immigrants because they all look the same and some of those regular immigrants might be friendly toward the terrorists, and none of those things were true about the IRA. So the then-extraordinary powers they got for their war against the IRA are now just standard police procedure, and now they need brand-new extraordinary powers.

To cut them a little slack, some of the reasons that they want new extraordinary powers written into the laws is that in the fight against the Irish, they often just ignored and violated laws about police procedures and generally got away with it, whereas today there's more visibility, more television publicity, and more European political concerns about human rights, so they want to make sure that when they're doing extraordinary violations of people's civil rights that they've got laws to permit them to do so.

Encrypted drives?

[WoTG]

What, so now that I do encrypted backups onto removable USB drives using Windows EFS, I'm at risk having to explain myself every time I cross the US border (I'm Canadian)? What's next? VPN software? SSH? SSL'd bookmarks in my browser?

The uncrackable algorithm

[syukton]

Write your own algorithm and use some section of Pi as your key. This way you can more or less safely forget the key and when law enforcement demands your key you can honestly say "it's four thousand characters long and I didn't memorize it." But then you know that starting at decimal digit 05201974 (which is your brother's birthday, or whatever, transcoded into a string of digits representative of the offset in Pi that the key can be found at) and for the next four thousand digits is the key. You know something which can get you the key, but you don't know the key itself. It's kind of like not having a housekey but knowing there's one under the doormat.

As for the algorithm, I don't know much about encryption but I came up with something a while ago that seemed interesting to me because it almost guaranteed randomization of data. Basically, the file would be sectioned into "chunks" of some size (determined by the key) and then each chunk would have its bits cycled (shifted either left or right, wrapping around) a certain number of times (which is not an identical amount for sequential chunks). In this way, sequential occurences of the same word or phrase in a text document would not likely look anything like one another, especially if each chunk is an obscure size like, say, 13 bits, or 67 bits, or 974 bits. Using a value that is not a common data storage value also lends to the scrambling. That is, don't scramble bytes or words or doublewords, but 3/4ths of a doubleword or 7/8ths of a byte. Maybe conventional encryption already works in this fashion, I don't know. Like I said, I don't know much about encryption.

By using your own encryption algorithms and by using a key which is so unimaginably large that you just couldn't possibly memorize it (maybe it's the first two paragraphs of Moby Dick, maybe it's the entirety of Genesis from your King James Bible, maybe it's the Declaration of Independence) you ensure that they aren't going to get at your data anytime soon.

Re:256? 3des? no.

[Kjella]

256-bit anything cannot be brute forced.

It sounds funny, but it is true. Check out Boltzmann's constant. Quote: "Given a thermodynamic system at an absolute temperature T, the thermal energy carried by each microscopic 'degree of freedom' in the system is on the order of magnitude of kT/2" The Background Radiation is at 2.725K. That means any action will use at least 3.76227207 × 10-23 joules. You have 2^256 = 1.15792089 × 10^77 possible keys, which gives 4.35641342 × 10^54 joules. The sun's mass is 1.98892 × 10^30 kilograms, which by E = mc^2 means 1.78755215 × 10^47 joules. This would mean 24 370 832 stars like the Sun, which would be far more than all the stars you can see with the naked eye. And all would have to be converted to pure energy, not fusion. If you want to do it by fusion, you have to blow up the galaxy.