Slashdot Mirror
UK Government Can Demand You Hand Over Encryption Keys
iminplaya writes "The UK government can now demand that citizens hand over their data encryption keys - or face jailtime for obstructing justice. The law only applies to data on UK shores, and doesn't cover information transmitted via UK servers across the internet. 'The law also allows authorities to compel individuals targeted in such investigation to keep silent about their role in decrypting data ... The Home Office has steadfastly proclaimed that the law is aimed at catching terrorists, pedophiles, and hardened criminals--all parties which the UK government contends are rather adept at using encryption to cover up their activities.'"
RIPA has had a lot of negative coverage since the idea was first raised. Someone at the time proposed emailing the Home Secretary with a few MBs of random data and the text 'here is the information on your opium import operation. The key is as we agreed' and then sending a tip to the police. If the Home Secretary does not disclose the key (which he doesn't have) then he is liable for 5 years of jail time. Or, the government could see how silly the act is and repeal it. Since the law just went into force, I expect civil liberties groups will start trying this soon.
I am TheRaven on Soylent News
GnuPG has a --show-session-key command, so that when you are asked to reveal the key for an encrypted message you can comply with the law by revealing the session key that was generated for that specific message rather than your secret key. This complies with the letter of the law, so you can ask for a written order for each individual message. Of course if they are really serious at this point they will smile at your request and get out the rubber hoses....
I was wondering how the court would rule if your password contained information that would incriminate you in a different crime.
For example, if your password was: "my_murder_victim_is_buried_under_my_patio" or "I_embezzeled_20million_into_account_123456789", wouldn't revealing the password violate your right against self-incrimination (at least in the US)?
Reading code is like reading the dictionary - you have to read half of it before you can go back and understand it.
That's the problem - forgetting the password is not a defence. Failing to hand it over when asked carries up to a 5 year jail sentence, as it's assumed whatever you're 'hiding' would cause you to be imprisoned. The basic premise, if you use encryption, is that you are guilty of something and it's up to *you* to prove otherwise by letting the police rifle through *all* your data looking for something incriminating. Failure to do so is evidence itself of guilt!
This law was passed 7 years ago, and the home office has been quietly waiting for the original outrage to die down to see if they could get away with actually using the powers they were granted before 9/11 or 7/7. Of *course* they'll only use it against terrorists and pedophiles. Nothing to fear citizen, sleep soundly in your bed, safe in the knowledge we're only imprisoning bad men. After all, only bad men use encryption then forget the password...
Of course, if you're a pedophile you're far better off taking the 2 years for failure to hand over your encrypted data, than to take the potentially decades in jail if you have incriminating photos and a sex offender offence that might well get you killed there. I don't think it'll be too long before the maximum sentence gets raised to be in line with the worst crime you might be assumed to have committed and hiding via encryption...
Remember kids, it's all fun and games until someone commits wholesale galactic genocide.