Slashdot Mirror
First Use of RIPA to Demand Encryption Keys
kylehase writes "The Regulation of Investigatory Powers Act (RIPA) is being used for the first time to force an animal activist to reveal encryption keys for encrypted files she claims to have no knowledge of. According to the article, she could face up to two years if she doesn't comply."
how can you be put in jail for not knowing something?
There are a number of problems with these sorts of laws. One is if the person lost the keyfile which is required to open the file, or if the encrypted volume got corrupted or if the keyfile became corrupt the file can't be decrypted without cracking it. There just isn't any good way of knowing for sure if the person gave a bad password or if there was a genuine problem with it.
Two is that there isn't genuinely any way of knowing what has been encrypted, it could be evidence of wrong doing, or it could be just some sort of embarassing, but legal, porn.
Three is that there is a tendency of these sorts of laws to end up sending innocent people to prison for not being able to reveal the information in a virus or malware encrypted file.
It is a tough situation, increasingly people engaged in illicit activities are turning to encryption as a means of keeping evidence secret, and from a technical standpoint refusing to decrypt the information is obstruction of justice.
"I don't see why encrypted files should be any different than hardcopy or anything else that could be seized under sub poena."
The police already _have_ the files. They're free to try to crack the encryption on those files.
While I intensely dislike the animal rights nutters, this is a stupid and oppressive law which should never have been passed. And I can quite believe that the police she was raided by are 'thugs'; ask that guy they shot eight times in the head a while back if that's a good description... oops, you can't, he's dead.
If such a law were enacted in the US, we would be protected, ostensibly, by the 5th amendment to the Constitution. I say ostensibly because apparently the Constitution is "just a piece of paper" now, and we (some of us) have forgotten about the rule of law.
So, this could happen here. Easily. We need to find some way to restore the rule of law here lest we become like that other large country just across the Bering Strait from us.
Hmmm...
Of course, this makes me wonder something from a 'thought police' perspective. With the file in question being a common TrueCrypt encrypted volume that doesn't really contain anything incriminating:
TP: Give us the passphrase!
Suspect: It's HotSmokinBabes
TP: Now give us the hidden volume passphrase!
Suspect: It doesn't have a hidden volume.
TP: LIAR, give us the passphrase!
Just because the possibility exists, the authority in question might ask for something he cannot prove isn't there. If you have nothing to give, this leads to the problem of lying to authorities to give them what they think they want, when you've already given them what they asked for and it proves you innocent. Aren't these going to be fun times to live in.
This is an outrage. Here, we have a case where a person claims she does not know something, but the government is demanding of her to comply. But let's suppose, for a moment, that she is telling the truth and she has no knowledge of these encryption keys. How could she prove it? There is no way to prove a negative. It is impossible to prove that you DON'T have something; you can prove that you DO have it by producing it. There, you see, I have it. But if you don't have it, there's no way to prove it. They should let her go.
Encrypting your data and not hiding it is the same as getting a $100k super secure safe, locking your stuff in it, but leaving it in the middle of the living room. Any { law enforcement agency / criminal gang / anyone with more resources and more muscles that you } will just force you to give them the key. In other words, they see the super secure safe and automatically assume there must be at least $1M in there and then they force you to give them the key. The govt will cite all kinds of stupid idiotic laws, the criminals will start cutting of the fingers (yours or your loved ones').
The solution is to use something like steganography and hide the data such that nobody even will suspect anything. The best secrets are the ones that are not even known to exist.
If the adversary is convinced that you do have the data and knows the data type, then create a similar but fake data set to be substituted for the real one.
The difference is, they didn't make a special law of 'failure to open a safe on demand' with up to 5 years in jail if they suspect the safe contains terrorist materials (2 years for everything else). "reasonable suspicion of evidence" is the important point; there's no such requirement under RIPA.
There are already laws against perverting the course of justice and hiding or tampering with evidence. The difference is that they have to show some evidence that there's relevant evidence in the safe. If RIPA applied to safes, they'd just have to show you have a safe and won't open it. They only have to have a 'reasonable belief' that you can open it, and having it on your property, or on property in any way associated with you is enough to meet that criteria. That's sufficient to carry up to 5 years in jail, regardless of what's actually in the safe, or what they can demonstrate might be in the safe.
The law is intended to allow them to put suspected terrorists and pedophiles in jail, even when they have no evidence they did anything illegal, and don't have the capability to brute force their encrypted files, and don't have sufficient grounds to charge them with something else. As we can see, once the british justice system get an 'anti-terrorism' power, it immediately becomes a tool to use against everyone.
Remember kids, it's all fun and games until someone commits wholesale galactic genocide.
Or at lest giving them a false sense if security.
If they're the type that need you holding their hand like that, do you really trust them with a system wherein they type a password then any app on the system is free to dump the entire volume? What good will that do when someone (govt or otherwise) sends them an exe in their mail that they happily run that just waits for you to decrypt the volume?
Maybe they're smart enough to not run exes so blatantly, but theres plenty of other potential code execution like software that autoupdates (+ big enough power forcing someone to sign their code so it validates), exploits, backdoors, etc.
Then theres the operating system holes in your security. Filenames and content will still end up in "recently accessed" lists in common software, that alone can be more than enough info. Theres the cleartext copy that ends up sitting in your swap file if the app swaps out. Backup/temp files saved outside the secured drive, etc.
TrueCrypt is useful for what it is, and I certainly use it daily, you just have to be careful with helping people into the world of security as they're looking for a panacea to do everything for them.
Pain lasts, kid. Its how you know you're alive. Sometimes I think this growing up thing is just pain management-TheMaxx
>>Five years later, turns out that it really was a virus. Sorry about that..oops, you're already dead, shanked in a prison shower.
fix'd
Even felons are taught to hate supposed pedophiles. Registered as a sex offender but turns out you're innocent? Too late, pariah for life. Registered for public indecency for pissing in a bush? Not our fault the us has no public bathrooms.
Correct- TrueCrypt has support for hidden and public volumes, both of which can use entirely seperate keys/keyfiles.
And again, this does only help against incompetent computer forensics people. Detectin the presence of such a hidden, encrypted volume is easy. Proving that it is encrypted and not cryptographically strong randomness is hard. But that applies to encrypted things that are not hidden as well and the attack here is not technological, but legal.
Come to think of it, I have a few disks that I wiped using cryptologically strong random data. There is no information on them, but I cannot prove that. In fact such a proof is fundamentally impossible in a very strong, mathematical sense.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
It's sad when you have to rely on TrueCrypt's plausible deniability to protect yourself from these things.
I agree. And AFAIK this law does not respect plausible deniability. Which also means that if the data is really random, they can throw you in prison and you cannot defend yourself.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
With encrypted files though, the police cannot get at them without your help. If you refuse to help, they cannot just "crack" the encryption (not even your equivalent of a secret service can crack it -- nobody can crack it in any reasonable amount of time, which is what scares the authorities). So realising they have no hope in hell of ever cracking a decent encryption scheme, they think they can just create a law that says your required to give up your keys. If they knew what they were dealing with, they'd realise however that such a law is complete nonsense. Since you cannot proof that a file is encrypted (since it looks like random data) you have the rather large problem that the authorities can claim any file with random garbage must be encrypted.
I don't think you understand how a hidden container works, it's not the same as a hidden partition. A hidden container is contained within another container, and looks just like random data.
During normal operation, you mount both the outer container and the hidden container using both the outer and hidden key. This enables truecrypt to see the hidden container and move around hidden data as you write to the outer container.
When you are arrested, you provide the key to the outer container, but not to the hidden one. In this mode, it's as if the hidden container doesn't exist and can of course be overwritten. There's absolutely nothing to prove that the hidden container exists, as long as you have a plausible outer container and can say "Look, this is what I was trying to hide".
Live today, because you never know what tomorrow brings
The present government corruption began as soon as our hairy forebears realized that people in positions of power would abuse those positions of power when given gifts. This can probably be traced back to the first time Ogg gave more meat to Oggette and her little Oglodytes simply because she was willing to grab her ankles for him.
It's human nature to try to twist the political structure to one's own ends, and it's a failure of modern society that 'the people' don't insist upon fairer means of government.
Very good point. However, I'd add that far too many people are willing to let this happen -- how many people follow the order, "Pay no attention to the man behind the curtain!" without question?
In addition to a secretive government being undemocratic, a population disinterested in the workings of government cannot produce a democratic government.
"Trolls they were, but filled with the evil will of their master: a fell race..." -- J.R.R. Tolkien on Olog-hai
The problem is, the law doesn't seem to place the burden of proof on the prosecution when it comes to showing whether there is or isn't any meaningful data present. Any old bits on a hard drive are (unqualified) electronic data.
On your point about circumstantial evidence, we really need not to set a precedent that says use of encryption can be treated as any sort of evidence, circumstantial or otherwise, that you are storing data of dubious legality. The implications of giving any legal weight to drawing that conclusion are horrible.
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
That was the list of "Legitimate Targets" when last I heard it. If you think for one instant that people working at a private medical research lab qualify, your standards are absurdly lax. Even if the mistreatment of animals qualified as a cause for violent struggle (it doesn't), regular employees of Huntingdon don't qualify for retaliation.
Its funny. Animal right activists always wage their violent protests and hate campaigns against scientists and business people. Where are the hate campaigns against slaughterhouse workers and farmers? Much if not most of the practices of these people are at least on the same level as animal research.
The fact is this. Violent animal rights activists are not committing these actions because they care about animals. They are committing these actions because they enjoy committing these actions. They enjoy harassing and threatening push over scientists and businessmen. They enjoy vandalism, petty crime and shouting people down. They enjoy it, it's that simple.
These people are middle and upper class thugs who have latched onto animal rights as an excuse to engage in violence. They need an excuse because their upbringings will not allow them to simply engage in it randomly.
Activists would never attempt any of their antics outside a slaughterhouse, because they would be quickly intimidated by the altogether more straightforward meat workers. Can you imagine what would happen if a violent animal rights protester spat on a slaughterhouse worker, or shoted abuse to them outside their home? I'd pay to see the results.
Vandalism, threats, pretending to be a terrorist movement, designating "Legitimate Target" (LOL), it's how they get their kicks. It's a giant LARP for these people, except that real people doing real research on real problems are getting seriously hurt by it. They're having their fun, and the animals have nothing to do with it.
Violent animal rights workers are simply bullies who pick soft targets, i.e. scientists, who they proceed to harass and abuse to make themselves feel better. They are not a legitimate movement. They are not a cause. They don't have a point of view. They are a rich kids' street gang, too afraid to actually walk the streets.
I don't approve of animals suffering needlessly. I find experiments like this one, or this contemptible, and if I was a research lab director, I wouldn't have approved them. I would however have approved less severe variations of such experiments. Ones in which while I knew animals might suffer somewhat, that they would not suffer needlessly or excessively. Animal research is necessary, and I defend its use, but only under the condition that the animals are treated with respect, and that their suffering and sacrifice is acknowledged. It's funny how more "primitive" cultures seem to follow such rules as a matter of fact, but our more "modern" scientists have to be reminded of it.
We need science, but we also need our consciences. Animal rights activists have neither.
May the Maths Be with you!
Tool = XOR
Key = RandomData XOR Magna Carta
Doesn't take much time, or access to powerful computers.
You don't have to prove you're innocent, they have to prove you are guilty.
That kind of thinking is *so* pre 9-11.
Teacher hating very often fits into that same way of thinking.
Business and government are similar in that they are all staffed and run by people (that is, greedy grafty nasty people). They are different in that we elect our government people and there is some oversight of the work and the results - sometimes late, and sometimes shoddy, but the oversight is there.. A business on the other hand, involves no community decision, is run as a dictatorship and there is minimal oversight (less and less every day since the 80's).
I'm not anti-business, just honest. The problems come from the people, not the organizational method. The organizational method is supposed to be a way of compensating for the problems while minimizing the bad side-effects.
Being anti-gov't or anti-teacher is just a way of parroting something you heard from someone else -- it's not a legitimate position to argue from.
When you initialize your encrypted disk space, you tell Truecrypt how many containers you want. Say that you choose 2. When you mount your Truecrypt drive, you must always mount both containers. In this way, Truecrypt knows and can maintain integrity between the two--they won't start to overwrite or corrupt each other, because they are both known about and available. If you ever only give the first key (you can't just give the second key, as the second container is entirely within the first) then you run the risk of corrupting the second container--in fact, any write operation will probably do it.
Now you can choose more than just two containers, and the same applies. One thing I'm not sure of is whether the third container is fully within the second. None of this, however, helps in hiding the existence of a PGP key. If your opponent has access to your email servers and can see you sending messages encrypted by PGP you're gonna have some explaining to do when it comes to investigation time. I don't know of any steganographic programs with plausible deniability that are out at this time. If anyone's heard of any please let us know. Even this has some subtle nuances.
If I am sending encrypted mail using PGP, I'm using someone else's PGP key. I don't have to have a PGP key myself in order to do this. If someone else is sending me encrypted messages, they could be sending it using anyone's PGP key--it's only obviously my key if it's provable that I've read the messages. For example, Alice could encrypt a message using Bob's public key, and then send that message to Charlie in an effort to frame him. Charlie gets the junk message and deletes it, but the feds who were wiretapping Charlie come in and demand to know what was in the message. Charlie can't answer--he has no idea. So he gets 2 years in prison from the RIPA act.