Slashdot Mirror
First Use of RIPA to Demand Encryption Keys
kylehase writes "The Regulation of Investigatory Powers Act (RIPA) is being used for the first time to force an animal activist to reveal encryption keys for encrypted files she claims to have no knowledge of. According to the article, she could face up to two years if she doesn't comply."
The Regulation of Investigatory Powers Act (RIPA) is being used for the first time to force an animal activist to reveal encryption keys for encrypted files she claims to have no knowledge of.
That's why you use an encrypted file system with a duress key. In the event of coercion, you give them a key that *oops* results in the destruction of the data.
The theory of relativity doesn't work right in Arkansas.
It doesn't. The courts have decided that an encryption key is analogous to a physical key. That's why the fifth amendment doesn't apply to encryption keys.
The cake is a pie
Filesize arithmetic?
You never used Truecrypt eh? It's not a zip file. It acts as a virtual hard drive partition that can be mounted as a drive.
When you create the volume it generates random bits throughout the virtual partition. You can copy whatever files you want onto the virtual partition, the rest of it is random noise. You may or may not choose to have additional hidden encrypted partitions within that noise. Adding up the size of know files tells you nothing about what may or may not lurk in the rest of the space on the virtual partition.
In the United States, you could never be compelled to turn over an encryption key as that is a violation of the 5th amendment
I wouldn't be so sure. The 5th amendment only protects against self-incrimination, but the search may be for evidence against a third party, in which case you may be compelled to comply.
It's also not clear that giving up your encryption keys would be considered "testimonial", so it might not be protected under the 5th amendment according to US courts. See here (somewhat outdated in other aspects, but an accurate reflection of US policy on the legal hair splitting):
http://www.cybercrime.gov/cryptfaq.htm
TrueCrypt allows hidden volumes, indistinguishable from one volume. The file size is constant.
TrueCrypt works very, very well. I use it with just one volume to protect passwords and other files.
When you don't want to encrypt a volume, but just a file, Gnu Privacy Guard is best.
I believe that depends whether or not they have a court order for it. In the US the 5th amendment only applies to interrogation and testimony. Basically self incrimination, but there is no protection against lawfully granted warrants. A refusal to hand over evidence when presented with an appropriate order or the destruction of evidence in anticipation of a lawful order is obstruction of justice.
I would assume that the British have a similar set up at this point. Otherwise, criminals would just say no, I'm not going to allow you to use your valid search warrant to gain entry and so that they could find that massive stash of child porn and Vicodin that I keep around for special occasions.
But, IANAL so I may be a bit off on this.
Several animal rights groups in the UK are officially designated terrorist organisations, because frankly they engage in acts of terror.
While I strongly disagree with this law (and would refuse point blank to hand over my passwords), the group that this woman belongs to has passed far beyond the bounds of legitimate protest, and needs to be investigated and disrupted by all legal means.
Access to financial data, call records etc. is already a key tool in criminal investigations, and is covered by RIPA in it's less draconian sections.
So long as the provisions of RIPA are adhered to, I see nothing wrong in police officers using such powers proportionately (i.e. only in cases where the seriousness of the offence merits such intrusion into my privacy) - most policemen that I have come across are professional, intelligent men and women who do a good job trying to keep the peace.
One swallow does not a fellatrix make
Linux-based imaging is good only if you are interested in recovery. On the legal side of things, it will not do:
- Please explain to the court how you made a copy of this piece of evidence...
- I connected the drive to our forensic machine and...
- You mean, you connected this hard disk... to your machine?
- Yes of course, then I...
- Did you use a hardware write block?
- Er... I used Linux and mounted the...
- Please, just answer the question. Did you or did you not use a hardware write blocker device to connect the disk to your machine?
- I did not, but...
- Thank you, no further question. I now call for the evidence to be declared tainted and inadmissible in court, since the forensic team failed to use the proper hardware to ensure that no changes would be made to the disk.
There is a whole range of forensic-specific hardware available: write blockers, hardware disk imagers... Use them, or loose your case.
I code, therefore I am.
I have to disagree with one of your points. Some of the most prolific terrorist groups are animal rights activists - they participate in letter bombing campaigns, arson and direct indimitation/attack of life science workers.
"Physics is to math as sex is to masturbation." -R. Feynman