Slashdot Mirror
UK Court Rejects Encryption Key Disclosure Defense
truthsearch writes "Defendants can't deny police an encryption key because of fears the data it unlocks will incriminate them, a British appeals court has ruled. The case marked an interesting challenge to the UK's Regulation of Investigatory Powers Act (RIPA), which in part compels someone served under the act to divulge an encryption key used to scramble data on a PC's hard drive. The appeals court heard a case in which two suspects refused to give up encryption keys, arguing that disclosure was incompatible with the privilege against self incrimination. In its ruling, the appeals court said an encryption key is no different than a physical key and exists separately from a person's will."
I wonder if it's illegal now to just forget. "I'd love to help you officer, but I guess I just forgot it!"
IIRC, that's been the case since the RIPA was first proposed. If the police come knocking and say "Give us the key", the burden of proof is on you to be able to show that you can't. (How on Earth you're meant to prove that you can't give them something like that is your problem).
Failure to give them the key can lead to 3 years in prison. There was also talk of a proposal whereby if you discuss the order to hand over the key with anyone, you can get 5 years in prison.
(All of this is based on several-year-old memories from articles in The Register, YMMV, IANAL, OMGWTFBBQ).
truecrypt
I read a while back about mandatory biometric scanning of tourists
I'm really hoping you aren't a US citizen as getting into the US now requires the scanning of all your fingers and of course the answering of the 7 stupidest questions in the history of questioning.
The bio-scanning stuff is a pain in the arse, but its unfortunately not a UK invention, it started in the US for "Security" reasons. You also now have to have a printed out copy of your itinerary (like that would be hard to fake) as an electronic copy on a PDA or laptop just isn't good enough.
An Eye for an Eye will make the whole world blind - Gandhi
Not quite, but TrueCrypt has supported hidden volumes for a long time. That is, the encrypted container has two passwords, one will open the main volume that you can fill with sensitive/private but non-incriminating stuff, while the other opens the hidden volume within the same container. It's also completely impossible to tell whether or not a given container has a hidden volume.
Nobody expects the British Columbia Human Rights Tribunal.
Yes and no. :-)
The "duress" key cannot possibly guarantee to erase the encrypted data - after all someone can make a copy of the encrypted data before entering the duress key.
However, OTP has a "duress" key (actually it has many). The real key decrypts the data to whatever you stored. But the duress key decrypts the same data to war and peace (or whatever you think appropriate). The duress key has to be regenerated every time the real data is changed.
One problem is that the two keys are each as large as the original data. So the fundamental problem becomes keeping the two keys secure and being able to supply the duress key without revealing the real key.
If you managed it sufficiently well, OTP is unconditionally secure in this way. Truecrypt attempts to do the same without the key management problem. As a result it's usable but there are possibly hints that will show that there is another key.
There are some other possible defenses - for example consider a disk encrypted with a key. If you shut down the computer correctly, the key is written to the disk (or a usb stick etc) before shutdown. If the computer is shutdown inappropriately then the key is lost. When the computer starts up again it reads the key but then generates a new one and proceeds to reencrypt the entire disk with the new key.
Of course, you're a bit screwed if the power fails.
I've actually considered trying to implement something like this using fr1 and network block devices to have a RAID1 setup on two computers. That way you're protected if one computer crashes for any reason. Put them on a UPS and you can decide whether you want to auto-shutdown when the battery gets low or whether you will require a special action otherwise the data is lost.
AIUI, in the UK when the police do a raid they're allowed to move the mouse to wake up the screen in case there's anything on it but after that the first thing they do is pull the power. So a UPS solution would be ok.
It's all a rather academic interest for me. I do have a small encrypted partition where I keep a record of usernames/passwords/secret information etc including banking information. I have a cron job that unmounts the encrypted partition every hour, so I don't forget and leave it mounted. But while it would be an enormous pain for me to have to disclose the key it's not something I need plausible deniability of knowing the key. (The partition is only 10Mb - initially at least I might try to withhold the key by arguing that whatever they were looking for could not possibly be just 10Mb but I'd not go to jail over it)
More concerning is that I've played with gpg, encrypted partitions etc and I've got stuff scattered around that is encrypted that I've no idea what the key is or was. Mostly I try and delete experiments like that but I do a nightly backup and I can go back several years so some of these experiments will be on backups somewhere. Unless the key is something like test, test1234, hello, fred then I'm never going to be able to decrypt it. (Of course, the emails I've encrypted have always just had the text "test", "test1234" etc so they're going to be a big disappointment to whoever manages to decrypt them :-)
Tim.
God said, "div D = rho, div B = 0, curl E = -@B/@t, curl H = J + @D/@t," and there was light.
Them claiming that hey dont need it is exactally why it becomes nothing and the court can step all over it like in this instance.
Where are these British people who claim they don't need a Bill of Rights?
In my experience, British people fall into one of three camps:
I have never heard a British person claim they don't need a Bill of Rights. I lived in Britain for 37 years.
One of the things that upholds the US constitution is its terseness, saneness, and closeness to the chartering of the national government itsself, although certainly its constant defence is the most critical.
[my italics]
I absolutely agree, and despair at the lack of outrage in Britain. If you could compare the justified anger on the Brits behalf here on Slashdot with the deafening silence in Britain you would be amazed.
If the british in this thread and in general dont respond to such a claim then is it any differnt than them not having a Bill of Rights in the first place?
I responded. I think that is one more person than has claimed that Britain doesn't need a Bill of Rights.
Because it's not real CP, it's random binary gibberish with a note attached saying 'Here is your encrypted CP'. The police will pick up that email (in other news today, they're going to be monitoring all emails) and go 'Oho, we have caught ourselves a paedophile and will soon look good in the newspapers when we lock him up for ever and always', and come around and arrest you. The they demand you decrypt the file so they can present you along with the CP to the court and get you sent to prison.
No CP exists - no key exists - it's not encrypted data at all, just noise. But you can't prove that. And so you go to jail for failing to provide the key.
Real Daleks don't climb stairs - they level the building.
Lucky for us Americans, a subpoena can not force you to testify against yourself. It's a Constitutional right written in black ink and cannot be revoked by any mere subpoena.
FOX NEWS.com should be BANNED from television and internet. Have the Congress take it over and give us Truespeak.
It's too bad there wasn't an awesome program like True Crypt (http://www.truecrypt.org/) that let you have two separate keys for an encrypted volume so that you could give a "fake" key that shows "fake" data.
I'm a big retard who forgot to log out of Slashdot on Mike's computer! LOOK AT ME.