Slashdot Mirror
UK Government Can Demand You Hand Over Encryption Keys
iminplaya writes "The UK government can now demand that citizens hand over their data encryption keys - or face jailtime for obstructing justice. The law only applies to data on UK shores, and doesn't cover information transmitted via UK servers across the internet. 'The law also allows authorities to compel individuals targeted in such investigation to keep silent about their role in decrypting data ... The Home Office has steadfastly proclaimed that the law is aimed at catching terrorists, pedophiles, and hardened criminals--all parties which the UK government contends are rather adept at using encryption to cover up their activities.'"
Truecrypt hidden volumes
This is exactly the sort of situation that hidden volumes were created for. The government asks you to hand over your encryption keys? "Well sure officer, here's the key to my encrypted volume, but there really isn't anything on there besides some harmless porn (or anything else that might be plausibly embarrassing enough to keep hidden away)" Of course, it's probably only a matter of time before someone decides to make it illegal to possess programs that can create any sort of hidden volume, but that's another issue.
A terrorist/pedophile/whatever is arrested, and his computer is seized. The authorities demand the suspect hand over the key, or he will face obstruction of justice charges and a year in jail. Does he
a) Tell them to get bent, go to jail for a year as a symbol of government run rampant (face it, some "activist" will pick up his "cause")
or
b) Immediately hand over the key, which is then used to procure the evidence of his computer, putting him in jail for 20 years as an ACTUAL terrorist/pedophile.
That's not even getting into the situation if one is NOT an actual pedorist. Terrorphile?
"As God is my witness, I thought turkeys could fly." A. Carlson
For private communications, don't send encrypted emails. If the encrypted email is captured by a wiretap, the fact that the ciphertext could be decrypted by the recipient is enough to allow the authorities to force that recipient to decrypt it.
Instead, you should establish an encrypted connection, use it to exchange private information, then destroy the keys after the connection is closed. SSH is one protocol that does this automatically. That way, although a wiretap can record the ciphertext, the authorities cannot retrieve the encryption keys because they no longer exist. Your democratic right to privacy is preserved.
I wonder if any instant messaging programs have implemented this? If so, do they consider the possibility of man-in-the-middle attacks as SSH does?
>north
You're an immobile computer, remember?
If the government has no confidence that you've turned over *all* the keys, won't they just put you in jail indefinitly even after you've turned over the keys?
All ideas^H^H^H^H^Hprocesses in this post are Patent Pending. (as well as the process of patenting all postings)
Since part of the law prohibits telling anyone that you have had to hand over the keys, how can you be sure about that ?
Digital keys are not physical items. This is like them demanding that you hand over your thoughts. In the US, and many other countries, there are laws stating that you have the right to remain silent, and that you don't have to testify against yourself. If you don't hand over the keys to your house, car, or safety deposit box, there's other ways of retrieving such physical objects by just taking them from you. If you don't hand them over, and they have a search warrant, they are allowed to break the lock. They can't do that with thoughts in your head.
Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
2 reasons I have a problem with laws such as this.
1) They violate your rights against self incrimination. Per the US constitution, I cannot be compelled to testify or offer evidence against myself. What this law says is that I MUST testify against myself, in the form of giving up *knowledge* that I have for the state to use against me.
2) While the warrant may be issued for a small piece of information, it has the potential to lay all your secrets bare. Let's say I am accused of child pornography, and that's what the police are "looking for" in the encrypted directory marked "Private". All of the data in that directory is subject to discovery. So if they find pictures of my infant daughter without her onesie, and figure out that this is simply a divorce case gone bad, the child porn investigation dies. But now they have also seen my financial records, and discover that I've made some questionable tax deductions, and the case now gets referred to the IRS. Or they find money that I've been hiding from my ex-wife, and hand her that info.
"As God is my witness, I thought turkeys could fly." A. Carlson
The really evil part is that you can be forbidden from telling anyone that you were forced to decrypt your documents, under penalty of imprisonment. Without public scrutiny, this law is inviting abuse.
Paid Q&A/Research
But...
Unfortunately, as soon as computer technology is involved, even some otherwise highly intelligent people instinctively turn off their brain and may be convinced that the existence of an encrypted file on your hard drive is tantamount to being found in possession of a giant underground bunker complete with piranha tank, spy-bisecting laser and fluffy white cat.
In a survey of 100 programmers, 111111 thought that duck-typing was a good idea.
I don't think you quite understand the principles behind "hidden volumes" in Truecrypt.
;-)
The point is not that they don't know it is possible. The point is that it cannot be proven that there is a second encrypted volume within the first one.
This makes it plausible to deny that it exist at all. If store some sensitive information in the outer volume, like some very embarrassing but not illegal pornography you can make a claim that this was the sole purpose of the outer Truecrypt volume. The law enforcement agency will have a hard time getting a judge to order you hand over keys to a hidden volume they cannot prove exist.
Hidden volumes in Truecrypt got nothing at all to do with "security through obscurity", it's all about "plausible deniability". You can ask your friend in the police about that, if he has any experience with the security community at all he should be very well acquainted with this term.
Of course, if you admit or in other ways make it provable that there exist an inner volume then all bets are off
This will probably work in societies like USA and UK where the police have to follow certain procedures. In countries like Burma or China where they will just torture you until you confesses or dies, I'm not so sure about the value of this scheme.
"I guess when wire-tapping and CCTV just isn't enough"
The issue, of course, is that systems are being put into place that can be used against citizens who protest. By using "terrorism" to create fear, those who want corruption and control are building systems that can be used to give them more control. Laws that required centuries to build are now being thrown away with as little awareness by citizens as can be designed.
The movie Zeitgeist explains it: The movie Zeitgeist (2007) claims to explain it all, from an example of how people are controlled by myths, to how people who control government use fear to get more control, to why the U.S. government is pursuing a policy of hyper-inflation of the dollar now.
The movie is free and can be downloaded using a BitTorrent client, burned to a CD (a DVD is not necessary), and most modern DVD TV players will play it.
The Zeitgeist movie is very poor in some places, such as the opening sequences, and excellent in most places.
Don't expect emerging consciousness of very difficult subjects like those in the movie Zeitgeist to be free of error. The movie correctly says that "resurrection after 3 days" is part of many ancient myths, with an astrological background. However, the movie also speculates that Jesus Christ may never have existed. That is beside the point. In fact, whether Jesus Christ existed or not, many people in the world thought that his ideas and the ideas of his follower Paul of Tarsus were an improvement over what they had before. Even many people who do not claim to be part of a religion think that.
Those who want more information about how corrupters use fear can watch the free 3-Part BBC movie: The Power Of Nightmares: The Rise Of The Politics Of Fear (2004).
For those who don't know, and want to know what is happening and why, those movies are an excellent and entertaining way to start.
For people and their friends who invest in weapons and the manipulatable parts of the oil business, such as Cheney and the Bush family, controlling the government is how they make money and get more power. People from rich families often grow up believing that it is acceptable for them to kill people to get what they want. It is difficult, however, for the average person to believe that someone who already has a lot of money would kill others simply because he wants more money.
I am surprised at how much conflict of interest is allowed in the U.S. and U.K. governments. Why are weapons and oil investors like Cheney and Bush allowed to decide about starting wars in countries that have oil? (Afghanistan may not have oil, but oil investors want to build a pipeline through Afghanistan.)
Now the U.S. and U.K. governments are planning to start a war with Iran, another oil-rich country.
TrueCrypt has "plausible deniability. I wondered why TrueCrypt encryption software has "plausible deniability". I guess that is why. We will soon all be needing it.
>I forgot it.
Six months in the county lock-up will do wonders for your memory - which is what thi smart-ass response to the judge will get you.
I happen to have something on my drive right now which for the last half year or so I have been *trying* to remember the password. I would delete it but for the slim chance I might be able to remember the password some day, or that a relevant cracking program might eventually be developed.
Nazi fuckers like you and these UK government government deserve a chainsaw enema. Being "tough on crime" is a mental defect when you are blind/unphased about imprisoning innocent people in your Crusade.
Oh wait, I forgot. Anything which makes it more difficult to catch and convict criminals must itself be made criminal. The fact that anyone ever posesses anything encrypted means they must already be a criminal.
-
- - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.