In UK, Two Convicted of Refusing To Decrypt Data

ACKyushu clues us to recent news out of the UK, where two people have been successfully prosecuted for refusing to provide authorities with their encryption keys, resulting in landmark convictions that may have carried jail sentences of up to five years. There is uncertainty in that the names of the people convicted were not released; and without those names, the Crown Prosecution Service said it was unable to track down details of the cases. "Failure to comply with a section 49 notice carries a sentence of up to two years jail plus fines. Failure to comply during a national security investigation carries up to five years jail. ... Of the 15 individuals served, 11 did not comply with the notices. Of the 11, seven were charged and two convicted. Sir Christopher [Rose, the government's Chief Surveillance Commissioner] did not report whether prosecutions failed or are pending against the five charged but not convicted in the period covered by his report."

Comments

Self-incrimination becoming mandatory

[mseeger]

This means, you can be forced to do self-incrimination. What's next? Do we remove the right to remain silent? In dubio contra reo?

Re:Self-incrimination becoming mandatory

[im just cannonfodder]

part of the law is that if you get a demand from the police you are not allowed to tell anyone about it other than your solicitor.

so no public accountability yet again by our government.

http://www.ckwop.me.uk/Articles/article01.html

An analysis of Section 3 of the Regulation of Investigatory Powers Act 2000 The Regulation of Investigatory Powers Act 2000 is a piece of UK law that, among a range of other things, contains a section that is meant to require the surrender of cryptographic keys to certain authorised parties (which are in effect instruments of the government). If such a request is made as part of an investigation, then the party who disclosed the key is not allowed to tell anyone that the authorities have that key or they face up to two years in prison. Equally, if the party fails to disclose the key, they also face up to two years in prison.

Re:Self-incrimination becoming mandatory

[L4t3r4lu5]

That went too. Remaining silent when they ask for your encryption keys is failing to provide the encryption keys.

Besides, we all know that the new system is heavily based on proving innocence. Innocent until speculated guilty, and all that.

Re:Self-incrimination becoming mandatory

[tygerstripes]

I'd be curious to learn how many of the four who did comply were subsequently convicted of the crimes for which they were being investigated, and what sentences these convictions entailed. I'm also very curious about what prevented the conviction of the other non-compliant nine. Essentially: was it worth it?

While I can see the arguments for and against permitting Section 49 sanctions, I want to know what the practical upshot is. Hypothetically, it may be worthwhile to a potential criminal to serve up to a couple of years in prison with a note on their record akin to "refused to assist in investigation" rather than face the potentially much more damaging convictions that their cooperation might incur.

My concern is that the law will be amended to reflect this, leading to much harsher sentencing in order to prevent this kind of cost-benefit decision being made by suspected criminals.

Re:Self-incrimination becoming mandatory

[thbigr]

Do the same laws of self incrimination apply in the UK?

Re:Self-incrimination becoming mandatory

[Anonymous Coward]

This means, you can be forced to do self-incrimination. What's next? Do we remove the right to remain silent? In dubio contra reo?

This is the UK. They already have removed the right to remain silent in the Justice and Public Order Act 1994.

Re:Self-incrimination becoming mandatory

[maxwell demon]

This means, you can be forced to do self-incrimination. What's next? Do we remove the right to remain silent? In dubio contra reo?

This is the UK. They already have removed the right to remain silent in the Justice and Public Order Act 1994.

I'm I the only one who at first misread the second 9 for an 8?

Re:Self-incrimination becoming mandatory

[TheVelvetFlamebait]

Wait, isn't this more like police demanding you unlock a door? You can't hide evidence behind a physical lock, so why should a digital lock be different?

Re:Self-incrimination becoming mandatory

[FinchWorld]

Any safe can be broken into, especially if its the police doing it, because no ones going to arrest them half way through the attempt. So key or no key, there getting what they want, though they may have something of a dim view of you come sentancing if you didn't give them the key and whatever illegal activity was in the safe. If there was nothing in said safe, and the key really had been lost, the police more or less wasted there time and your not guilty of anything, after all they never found that key either.

However, with encryption it could well take the span of several peoples life times to crack a key needed to unlock the data, hence the law brought in. However if you have genuinely lost the key, or its destroyed, and you have nothing illegal encrypted, say bank details and the like, your going to prison anyway.

Re:Self-incrimination becoming mandatory

[Anonymous Coward]

Because you actually dont have to unlock a door, when asked. You just are not allowed to actively prevent the police to get through the locked door.

Re:Self-incrimination becoming mandatory

[Anonymous Coward]

"You do not have to say anything, but anything you do say will be taken down and may be used as evidence against you" is the standard line for UK police. Either that, or "you're nicked".

Re:Self-incrimination becoming mandatory

[Anonymous Coward]

"Guilty as charged until proven innocent." There, that was easy.

Re:Self-incrimination becoming mandatory

[Anonymous Coward]

Oh, you still have the right. It's just that exercising that right comes at the potential cost of a jail sentence. Therefore you would balance the jail sentence you would get from providing the keys to the data you are hiding against not providing it. For certain types of data, it's a good trade-off.

It's the same as allowing juries to use silence from a suspect as a factor in their deliberations. Or exercising your rights as a journalist to not name your sources.

However there are other aspects in the UK law that are dubious, such as the first response to your post. Certainly there are V for Vendetta issues with the current government's laws, which are ill-thought-out by people who don't have the qualifications to actually make laws that a whole and complete, with checks and balances.

And certainly there are issues if it comes down to fishing expeditions. If you want to decrypt a file to look for, e.g., child porn, and instead you find accounts detailing drug dealing finances, or dodgy tax stuff, there should be nothing the police can do.

Re:Self-incrimination becoming mandatory

[badfish99]

Not any more. Now it is:

"You do not have to say anything. But it may harm your defence if you do not mention when questioned something which you later rely on in court. Anything you do say may be given in evidence."

The reason for the change is that the "right to silence" has gone: if you don't immediately tell the police your defence when you are arrested, the court may ignore anything you say in your trial, and convict you anyway.

Re:Self-incrimination becoming mandatory

[Anonymous Coward]

> "You do not have to say anything, but anything you do say will be taken down and may be used as evidence against you" is the standard line for > UK police.

Its not been that for a long, long time. The caution is now "You do not have to say anything, but it may harm your defence if you do not mention when questioned something which you later reply on in court. Anything you do say may be given in evidence."

I.e. the court can legally infer things from your silence.

Re:Self-incrimination becoming mandatory

[Pvt_Ryan]

What's next? Do we remove the right to remain silent?

Already done for motoring convictions.

Re:Self-incrimination becoming mandatory

[arbiter1]

The problem is they are making you provide evidence to convict yourself and send yourself to prison. its everything the 5th amendment is made to protect you from, at least in the US. They have the Data but you gotta provide the info to access it, this has president to remove all 5th amendment rights at some point, They get you to give up that key then next they will be asking you for more since you gave up that why not more

Re:Self-incrimination becoming mandatory

[Anonymous Coward]

In the UK the right to remain silent has effectively now been removed - the police no longer say

"You have the right to remain silent, but anything you do say will be taken down and may be used in evidence against you"

but instead say

"You do not have to say anything, but it may harm your defence if you do not mention, when questioned, something which you later rely on in court. Anything you do say may be given in evidence."

The Criminal Justice and Public Order Act 1994 provide statutory rules under which adverse inferences may be drawn from silence.

Adverse inferences may be drawn in certain circumstances where before or on being charged, the accused:

        * fails to mention any fact which he later relies upon and which in the circumstances at the time the accused could reasonably be expected to mention;
        * fails to give evidence at trial or answer any question;
        * fails to account on arrest for objects, substances or marks on his person, clothing or footwear, in his possession, or in the place where he is arrested; or
        * fails to account on arrest for his presence at a place.

Essentially, shutting up and saying nothing will be actively harmful to your defence.

Re:Self-incrimination becoming mandatory

[Anonymous Coward]

It is much worse than a door key for a number of reasons:

  * A door key only opens one of your properties, a decryption key can "open" all of your communications
  * An encryption key can also be your identity.

I've spoken to my friends in the UK police force and they do not have the systems in place to guaranty that my private key could not be used to forge my identity by a less than honest policeman if I ever disclosed it.

Re:Self-incrimination becoming mandatory

[DigitAl56K]

The police don't know what evidence is there with certainty until they can access it. If they are given the power to break open a physical lock because they have satisfied a judge (or any other requirement) that they are likely to discover evidence by doing so, that's one thing. However, they can get to that evidence with or without your help.

If they believe that decrypting a drive or file will provide evidence and they can get to that evidence without your help fine. If they can only get to the evidence with your help then they have no evidence. And this law is basically saying that with no evidence they can send you to jail.. because you won't help them prosecute you. Which is kind of contrary to the whole concept of legal trials: how can it be mandatory for you to do the work of the prosecution when you are the defendant?

Elsewhere in the discussion others mention the right to remain silent, and when you ask "isn't this more like police demanding you unlock a door? You can't hide evidence behind a physical lock, so why should a digital lock be different?" then there are a whole bunch of slippery slope questions. Isn't this like the police demanding you tell them where you were at the time of the crime? You can't stop them finding out (but they may never unless you tell them). Who were your accessories? You can't prevent forensics from determining that so you should have to tell them!

But really, let's simplify it:

"You can't hide evidence behind a physical lock, so why should a digital lock be different?"

Because it is different? You can hide evidence behind a digital lock, and you do have the right to remain silent. Sometimes. Apparently.

BTW I am from the UK and I grow more ashamed of the people who govern it almost every day.

Re:Self-incrimination becoming mandatory

[TranceThrust]

That was my first thought too. In that light, can (couldn't) they still appeal, perhaps at an international court?

Re:Self-incrimination becoming mandatory

[Threni]

Although there is no law to prevent "self incrimination" it's not because it's recently been added - it's always been that way.

The bit about "it may harm your defence" is a fairly recent change, but it applies during questioning, and not during any subsequent court case.

You are free to ignore the police's questions or say "no comment" but try that in court and you're likely to be held in contempt of court, which is something you really don't want to happen to you.

Re:Self-incrimination becoming mandatory

[Admiral Ag]

That's not the point. The underlying problem is the assumption that the authorities have a right to access any evidence they feel is relevant. In essence, they are saying that there is no electronic communication or form of data storage that they should not have the right to access.
.
Notice that nobody asked people whether they were willing to give up absolute privacy over limited aspects of their lives in order to gain some limited form of security.
.
What if in the future it were possible to read thoughts or extract memories by means of brain scans? Would any sane person think the authorities have any rights to invade people's own thoughts? The privacy of one's own thoughts is essential to living a human life.
.
If you agree with that, then you need to take into account that sometimes we store our personal thoughts in other media. An extreme example would be a thought experiment involving someone who has no long term memory who writes down everything he has to remember into his PDA (which is now functionally his "memory" - thanks to David Chalmers for this example, although I'm not sure it is originally his). From the point of view of personal privacy, there is really no difference whether one's personal private thoughts are stored in internal or external memory systems. That being so, it follows that for the police to assume they have a right to access any externalized information (such as that recorded on the man's PDA) is a gross violation of privacy and a fundamental disrespect for the value of individual personhood.
.
The law needs to have strict limits on what can and cannot be accessed by the authorities, and in order to protect privacy in a meaningful sense, some things must remain absolutely off limits to the police. So what if this makes crimes harder to prosecute? Either we increase the police budget or tell them to get off their asses and do some old fashioned police work to catch criminals.
.
The old "some people have kiddie porn, so everyone must surrender their right to privacy" argument just does not wash with me.

Re:Self-incrimination becoming mandatory

[TaoPhoenix]

Get the officials the Staples button.

Re:Self-incrimination becoming mandatory

[extremescholar]

No, no, no. One is innocent until proven guilty in a court of law. However, a cop on the street doesn't follow that. You're guilty, he/she just needs to figure out what it is your guilty of.

Re:Self-incrimination becoming mandatory

[Anonymous Coward]

yeah, thankfully we can plead the 5th here in the USA.

Re:Self-incrimination becoming mandatory

[Anonymous Coward]

What's next? Do we remove the right to remain silent?

That's American. The UK has a law that assume guilt when presented with silence for certain charges.

Re:Self-incrimination becoming mandatory

[BlueStrat]

While I can see the arguments for and against permitting Section 49 sanctions, I want to know what the practical upshot is. Hypothetically, it may be worthwhile to a potential criminal to serve up to a couple of years in prison with a note on their record akin to "refused to assist in investigation" rather than face the potentially much more damaging convictions that their cooperation might incur.

My concern is that the law will be amended to reflect this, leading to much harsher sentencing in order to prevent this kind of cost-benefit decision being made by suspected criminals.

Since suspects could be hiding evidence of a capitol crime, would that logic then dictate that the only way to make divulging that evidence more likely would be to make the punishment *worse* than the worst normally-legal punishment? Ie; a death sentence where life in prison is the most severe punishment for a capitol crime, or torture THEN death in places where the death sentence is already legal?

Death by "snu-snu" maybe?

Well, I for one welcome our...

Ahh, forget it! That's just shooting fish in a barrel!

Strat

Re:Self-incrimination becoming mandatory

[Zemran]

There is not a death sentence in the UK...

Re:Self-incrimination becoming mandatory

[Zemran]

The right to silence remains. You do not have to answer any questions. The only thing that changed is that they can now say that you did not answer the questions. Prior to the change in the law the police were not allowed to say that you had not answered their questions and that meant that they could not say that they had asked because it is hard to say that something was asked without saying that there was not an answer. This was obviously a stupid situation and was rectified. If you chose not to answer the police can now tell the court that they asked you and you refused to answer, and that can harm your defence (as you are warned).

Re:Self-incrimination becoming mandatory

[Rogerborg]

I'd be curious to learn how many of the four who did comply were subsequently convicted of the crimes for which they were being investigated

Bear in mind that the State can force Alice to hand over keys in relation to an investigation on Bob, so it's not even a case of prosecuting the guilty, just the forgetful.

Re:Self-incrimination becoming mandatory

[Anonymous Coward]

Take your commie people's rights elsewhere. The problem is that we don't want people to get away with just 5 years for not disclosing their decryption keys when we know that they're hiding something that would put them away for a much longer time. So we charge them with what we know they've done and if their obstruction of justice prevents us from proving their guilt, then there is only one way to get them anyway: They have to prove their innocence or they're guilty as charged.

Re:Self-incrimination becoming mandatory

[Zemran]

This should go to Europe as it is clearly unconstitutional. This clearly contravenes the individuals basic human right to a presumption of innocence. I doubt that this will last long as even if these guys do not take to the European court someone will later, but it will cause a lot of Blighty bashing here on /. in the mean time.

Re:Self-incrimination becoming mandatory

[Anonymous Coward]

Yeah. Only being arrested and suspected of a crime may be stressfull as hell and affect your memory. And then try to remember your jÃlrGREG3 -password.
So basically if you ever encrypt any data, be sure that you remember your password in any situation or you may sit next five years in prison

Re:Self-incrimination becoming mandatory

[TheP4st]

What if in the future it were possible to read thoughts or extract memories by means of brain scans? Would any sane person think the authorities have any rights to invade people's own thoughts? The privacy of one's own thoughts is essential to living a human life.

While the sanity of the "Think of The Children/If You Have Nothing To Hide" group is debatable, they would with little doubt have a simultaneous orgasm the moment that became reality.

Gah! I just had a very very nasty mental image of a million Becks, Palins, Bushs' and so forth. *shudder*

I now hope that if the tech to extract memories become reality that it also will be possible to erase them for desperate times as this.

Re:Self-incrimination becoming mandatory

[OutOfMyTree]

"...if you don't immediately tell the police your defence when you are arrested, the court may ignore anything you say in your trial, and convict you anyway."

Of course the court can't ignore anything and everything you say at trial. But they can discount the prefect alibi which you say today your brother would have given you, if only he hadn't left for Antarctica yesterday. You cannot now ambush the prosecution with a totally new defence involving facts which you knew but kept secret, so that no investigation of them could be done.

Defendants have a right to know what they are accused of. Now the prosecution has a right to know what sort of defence you intend to mount.

I am appalled that in some terrorist cases in the UK the full details of the accusation may not be told to the accused and his legal team. At the same time, I do not like the old pattern of the accused getting off because out of the blue they called as witness Mrs Bloggs, without the prosecution having time to establish that she is actually the defendant's Great Aunt Sadie with a criminal record even longer than his.

As @Kupfernigk says, bumpy progress is better than no progress.

Re:Self-incrimination becoming mandatory

[Anonymous Coward]

Probably. 1984 references stopped being clever 10 years ago.

Re:Self-incrimination becoming mandatory

[The_Quinn]

Besides, we all know that the new system is heavily based on proving innocence. Innocent until speculated guilty, and all that.

That is a debatable statement, and therefore considered illegal under the new Stop Misinformation Act. I am forwarding this to the Internet Snitch Brigade.

Re:Self-incrimination becoming mandatory

[Tenebrarum]

This means, you can be forced to do self-incrimination. What's next? Do we remove the right to remain silent? In dubio contra reo?

Perhaps someone's said it already, I cba to read every reply--the right to remain silent went before the right not to self-incriminate. Guilt can be inferred by silence.

...and as for the two mentioned, where do I donate money, protest or find out how to help with publicity?

Re:Self-incrimination becoming mandatory

[BlueStrat]

There is not a death sentence in the UK...

Which is why I specifically stated;

"Since suspects could be hiding evidence of a capitol crime, would that logic then dictate that the only way to make divulging that evidence more likely would be to make the punishment *worse* than the worst normally-legal punishment? Ie; a death sentence where life in prison is the most severe punishment for a capitol crime, or torture THEN death in places where the death sentence is already legal?"

See how I ever-so-cleverly included places that do and places that do not have a death sentence in just such a way as to trick people into believing I didn't mention it at all?

Darned slick if you ask me! :D

Depressingly, it seems Congress has caught on to using this technique also as bills like TARP, the "stimulus", and the health care bills would seem to demonstrate.

Strat

Re:Self-incrimination becoming mandatory

[Nitage]

Too late! The UK government has already removed the right to silence. Remember when the magic police arrest wording changed from: "You do not have to day anything..." to "You do not have to day anything but it may harm your defence if you fail to mention when questioned something that you later rely on in court..."

Re:Self-incrimination becoming mandatory

[IamTheRealMike]

It's in TFA:

The Register has established that the woman served with the first section 49 notice, as part of an animal rights extremism investigation, was not one of those convicted for failing to comply. She was later convicted and jailed on blackmail charges.

and

Sir Christopher did not report whether prosecutions failed or are pending against the five charged but not convicted in the period covered by his report.

Re:Self-incrimination becoming mandatory

[mdm-adph]

So, just a healthy modicum of "snu-snu," then. I'm game.

Re:Self-incrimination becoming mandatory

[hesaigo999ca]

I guess freedom, is just not that free anymore

Re:Self-incrimination becoming mandatory

[Anonymous Coward]

Sadly, yes.

In the UK you no longer have the right to remain silent, and for certain offenses ("anti-social" behavour etc.) no right of trial : simply the accusation of the police officer is enough to prove guilt, and require the payment of a fine.

The 800 year old law against double jeopardy has also been repealed in the UK : http://news.bbc.co.uk/1/hi/uk/4406129.stm

The right to jury trial, another ancient right, has been removed.

Finally the government now intends to remove the right to a state-paid lawyer for all cases, meaning that many people may well end up representing themselves against the state's own lawyers. Startling, sad, and all true.

Re:Self-incrimination becoming mandatory

[malkavian]

No. They simply put you on the various databases that 'accidentally' label you as a child abuser or some such, prevent you from doing any work (CRB, and various 'trust' database entries) and hound you 'till you commit suicide. They can't tell anyone to kill you (well, unless it's on national security grounds, and then quietly), but they can make the choice to stay alive a very difficult one.
Yes, there have been cases.

Re:Self-incrimination becoming mandatory

[cbiltcliffe]

At the same time, I do not like the old pattern of the accused getting off because out of the blue they called as witness Mrs Bloggs, without the prosecution having time to establish that she is actually the defendant's Great Aunt Sadie with a criminal record even longer than his.

So you'd rather have an innocent person with a somewhat shaky alibi get it shot full of holes and convicted of a crime they didn't commit, rather than a guilty person walk, who's likely to commit another crime later and get picked up again, anyway?

Remind me not to move to a country where you're a voting citizen....

Re:Self-incrimination becoming mandatory

[Anonymous Coward]

Nor do they care that there isn't. Extra judicial killings are completely legal anywhere in the EU.

Re:Self-incrimination becoming mandatory

[B1ackDragon]

Is that really what they say on arrest? I had to read that 3 times to understand it and the implications, I'm sure I'd have to have it said to me at least five times out loud.

Re:Self-incrimination becoming mandatory

[Anonymous Coward]

and that can harm your defence

You say that like it's the most natural thing in the world. The right to remain silent is a crucial defense against an oppressive police force. It should not harm your defense in any way if you did not talk to police officers.

Re:Self-incrimination becoming mandatory

[Vu1turEMaN]

I'm sorry, you lost me at Contra. NES defecit disorder kicked in.

Re:Self-incrimination becoming mandatory

[secondhand_Buddah]

Actually, that's any police force including cops in the US. NEVER volunteer information to the police. It can NEVER do you any good, regardless of how innocent you are..

Re:Self-incrimination becoming mandatory

[secondhand_Buddah]

This is an intimidation tactic. Your rights will still remain in better shape if you remain silent. It is so easy for a professional interviewer to get you to say things which will incriminate you, even if you are innocent. These people get information out of other people for a living. Unless you are trained in interrogation techniques your safest option is to remain silent.

Re:Self-incrimination becoming mandatory

[jrumney]

I don't know what this Capitol Crime is, it must be an American thing, but to rephrase the GP's point, there is no such thing as a Capital Crime in the UK.

Re:Self-incrimination becoming mandatory

[JediN8]

Hello! England!!!! The are still refered to as SUBJECTS. They have no rights.

Re:Self-incrimination becoming mandatory

[Shakrai]

Indeed. Here's two different videos to drive the point home, one from an attorney and the other from a police officer himself.

Never ever EVER talk to the police. Nothing you can say to them is going to help you. Shut your damn mouth and ask for an attorney.

Re:Self-incrimination becoming mandatory

[HangingChad]

This means, you can be forced to do self-incrimination.

Better five years for refusing to decrypt data that whatever the penalty is for child porn or handing over the bribe records of the local mafia. Here someone convicted of a crime like that would do, maybe, 9 months before getting probation. Beats being on the sex offender list for 25 years. Don't know if the Brits have the same sort of registry, but that wouldn't surprise me.

Not only that, but you could play the martyr card and claim your refusal was based on principle, not that you had anything to hide. You'd be hero instead of a pedo-zero.

Re:Self-incrimination becoming mandatory

[Anonymous Coward]

This means, you can be forced to do self-incrimination. What's next? Do we remove the right to remain silent? In dubio contra reo?

A warrant is issue for the evidence on your laptop. Said warrant is only issued with probably cause.

If you had a diary where you confessed to killing Jimmy Hoffa, and the police or court issues a warrant for that diary, it doesn't matter if it's a paper diary or a digital one (encrypted). You've been served the warrant and must produce the item(s) listed in it.

You are asked for the pass phrase to your encrypted data in a warrant which was issued with probable cause. Just as you can be compelled to give DNA evidence (which may convict you) with probable cause, you can be forced to reveal your encrypted data (which may convict you) with probable cause.

Re:Self-incrimination becoming mandatory

[Nathrael]

There actually is, but only for espionage, (violent) piracy and treason. No executions have been carried out though since August '64.

Re:Self-incrimination becoming mandatory

[Anonymous Coward]

Clearly you are not familiar with English Law; the right to remain silent went years ago. Silence is now treated as an admission of guilt in English Law as the UK Government decided too many "criminals" were being found not guilty because they remained silent during questioning and court proceedings so courts now get to treat silence as admitting guilt.

Re:Self-incrimination becoming mandatory

[metamatic]

This means, you can be forced to do self-incrimination. What's next? Do we remove the right to remain silent?

The UK already removed the right to remain silent in 1994. Criminal Justice and Public Order Act.

Re:Self-incrimination becoming mandatory

[Nathrael]

BTW I am from the UK and I grow more ashamed of the people who govern it almost every day.

Then don't just be ashamed, but use the 4 boxes - soap, ballot, jury, ammo (although using the last one may be difficult in the UK, which, like pretty much every authoritarian regime, loves to disarm it's citizens). If you want freedom, you have to work for it, and since the UK isn't Cuba or North Korea Mk.2 yet, you should start voicing your opinion on freedom in the UK right now.

Re:Self-incrimination becoming mandatory

[Anonymous Coward]

It's England, they're always a decade behind the times.

Re:Self-incrimination becoming mandatory

[Anonymous Coward]

Too late! The UK government has already removed the right to silence. Remember when the magic police arrest wording changed from: "You do not have to day anything..." to "You do not have to day anything but it may harm your defence if you fail to mention when questioned something that you later rely on in court..."

So one technique might be to 'jabber', ignoring any questions, but making sure that you mention anything you might rely on in court. It does not state you have to rely on everything you mention, so make sure to also mention things which are not true and contradict the (true) ones which you will be relying on.

  The other "problem" with the wording of the caution is "Anything you do say may be given in evidence". I am sure that if you said something (eg hearsay) which is not admissible in evidence that, despite having been told that anything said may be given in evidence, the court would not let you introduce it into evidence.

Re:Self-incrimination becoming mandatory

[Anonymous Coward]

Hysterical bullcrap. Yes, the court MAY ignore anything you say in your trial, but that happens all the time in courts the world over...if you do not present a credible case the jury may ignore what you say, or disbelieve it. All the re-worded caution means is "a jury may think it suspicious if you remain silent when questioned". Which just makes explicit what used to happen anyway - if a person is arrested and says nothing to the police, juries may indeed find that suspicious. The phrasing you have chosen makes it sound as if the court (i.e. judge) has a right to prevent a jury from hearing a defence you present in court because you did not use that defence when questioned by the police. That is not the case at all.

Re:Self-incrimination becoming mandatory

[jimicus]

Technically, they're meant to ask "Do you understand?" immediately after that and you're perfectly entitled to say "No, I don't understand, Officer".

In theory, they're then meant to produce a copy of the Police and Criminal Evidence act which you are free to read until such time as you do understand.

Whether or not anybody's ever got away with something simply by "not understanding" indefinitely I really don't know, but it's nice to think it may have happened.

Re:Self-incrimination becoming mandatory

[mlk]

My impression was that this is no longer the case as well. Wiki steams to agree with me:
http://en.wikipedia.org/wiki/Capital_punishment_in_the_United_Kingdom

Although not applied since, the death penalty remained on the statute book for certain other offences until 1998.

On 10 October 2003, effective from 1 February 2004[15] the UK acceded to the 13th Protocol, which prohibits the death penalty under all circumstances

Re:Self-incrimination becoming mandatory

[Anonymous Coward]

In the US, the legal argument against forced decryption or unlocking of digital files versus a physical lock is that the court/police can be certain that the key to the lock exists, i.e. revealing how to open it is not revealing any additional information. However, in the case of digital files, it is not clear that a key exists in the control of the defendant. (give or take, IANAL, but I did unfortunately have to deal with this sort of situation personally).

In the US, they can issue a subpoena for documents that are known to exist, or other evidence that definitely exists (such as your DNA, hair color, porn you previously decrypted for the border agent), but you can't be issued a subpoena for evidence that isn't definitely inside your control (such as a password that exists only in your memory).

It's a shame that the UK doesn't have any such protections... they're constantly walked all over in the US by self-righteous police officers, but at least when it comes to negotiation time, you can refuse to give them those non-tangible, possibly-existent information only in exchange for immunity.

Re:Self-incrimination becoming mandatory

[jimicus]

Don't know about where you are, but we have no right to silence in the UK. The police can quite legitimately demand to know why you didn't tell them earlier when you present your defence in court and encourage the judge/jury to infer from that the reason why you didn't tell them is because you invented it some time between arrest and court appearance.

Doesn't mean you should give them an easy ride by answering everything in excruciating detail, though.

Re:Self-incrimination becoming mandatory

[Shakrai]

It's depressing to think that all of the rights that I enjoy as an American came from the English Common Law and that the citizens of your country are busy surrendering those rights one by one. You've surrendered the right to keep arms, the right to keep silent, the right against self-incrimination, the right of privacy and most of the checks and balances of your Parliamentary system. Am I missing any?

Why do the British people tolerate this? Your history suggests that you should know better. What's it going to going to take before you wake up and vote the scumbags out of the Commons and/or rise up against them?

Re:Self-incrimination becoming mandatory

[Blue Stone]

I think the problem is that the life-long sentence of universal stigmatisation that can occur for giving the keys in some circumstances - sex offender - even if it's just an image of a 17-year-old's boobies or a sex act between people of legal age (but not over 18) - just cannot compare to a few, even several years in prison for 'forgetting' your encryption key. At least once you're out after a RIPA prosecution, you can rejoin society. If you're a 'sex offender' (whatever the poor justification) the government wants you to be forever excluded from society and stigmatised; your sentence will never end.

Re:Self-incrimination becoming mandatory

[OutOfMyTree]

Where did I say that? Or anything like it?

Re:Self-incrimination becoming mandatory

[xaxa]

I think they finish with, "do you understand?". I don't know what they do if you say you don't understand.

Re:Self-incrimination becoming mandatory

[BlueStrat]

I don't know what this Capitol Crime is, it must be an American thing, but to rephrase the GP's point, there is no such thing as a Capital Crime [thefreedictionary.com] in the UK.

And to rephrase *my* point, I am aware of this lack of a death penalty in the UK already and posted with that in mind and mentioned that situation specifically, which is why that point being made & re-made as if I had left it out is redundant.

I know I suffered a bit of Typonese, but am I writing with invisible ink too? :|

Strat

Re:Self-incrimination becoming mandatory

[n4djs]

IN THE UK. We in the United States use more traditional methods of getting you to cough up the passwords: http://www.xkcd.com/538

Re:Self-incrimination becoming mandatory

[tomkost]

A good post except the last part. We all have to take responsibility for electing those that govern. I know this seems like a difficult responsibility as the choices are quite poor. The only way to win here is to keep voting out incumbents until we find some who will reverse this trend. Those who would take our rights will run out of electable people sooner rather than later. BTW, I live in US and we have the same problem/responsibility. We can also write letters to our elected officials, and I do, but I feel they fall on pretty deaf ears. Voting out the scoundrels is the only "voice" they hear. To me, a good result would be when 80-90% of the incumbents lost the election. Rinse, lather, repeat. Good luck to our brothers and sister in the UK.

Re:Self-incrimination becoming mandatory

[Anonymous Coward]

WRONG! UK != England

Re:Self-incrimination becoming mandatory

[Anonymous Coward]

No, no no. One is innocent until proven guilty, unfortunately, what they do to innocent people these days...

Re:Self-incrimination becoming mandatory

[Dishevel]

Judging by your lack of ability to read I am going to guess you were educated in Los Angeles, CA in their public school system.

Re:Self-incrimination becoming mandatory

[RMH101]

It's the UK's Regulatory Investigatory Powers Act (RIPA) that came in quite some years ago. Yup, they thought of that, surprisingly. It is an offence to not provide the keys when asked: silence isnt' an option.

Re:Self-incrimination becoming mandatory

[RMH101]

Yup, a number of people who were arrested under the anti terrorism laws after the London bombings had leaks fabricated to the newspapers about child pr0n on confiscated PCs, etc which was later found to be untrue..

Re:Self-incrimination becoming mandatory

[Greyfox]

Or for that matter if you have a bunch of random noise on your hard drive anyone could claim it's an encrypted file and demand that you "decrypt" it. It'd be a great way to send anyone you don't like to jail. Or you could get your "forensics expert" to Xor the unallocated space on their drive with whatever incriminating documents you want them to have and then produce the Xor image as "evidence" to a judge and jury to get rid of someone who was annoying you. Why bother with actually having to find evidence if you know they're guilty, after all?

Re:Self-incrimination becoming mandatory

[MarkvW]

First: This is not the United States. Great Britain has a different legal system that was forged in circumstances very different from the American experience. Generalized application of US principles to GB cases is foolish. If you're going to compare the two with any meaning, you've got to do some thinking. And this is /.

Second: Don't assume that the provision of information equates to self-incrimination. It may--and it may not. The recent case of the idiot with the laptop at the border is a good illustration of how the self-incrimination issue can get a little complex.

Re:Self-incrimination becoming mandatory

[TheVelvetFlamebait]

All of the above assumes warrants were issued by appropriate systems, of course. Police need to have at least some faculty to inspect the private, otherwise they're, quite literally, completely and utterly useless.

Re:Self-incrimination becoming mandatory

[Anonymous Coward]

Ah the naivety.

Re:Self-incrimination becoming mandatory

[Nathrael]

Ah, thanks for the correction then :) .

Re:Self-incrimination becoming mandatory

[cbiltcliffe]

If you don't like the fact that the accused can get off by testimony from "Great Aunt Sadie," that implies that removing this possibility is a good thing.
Which also means removing the possibility of an innocent person getting off when they only have a somewhat shaky alibi.

Re:Self-incrimination becoming mandatory

[mrwolf007]

Yeah, sure sucks, doesnt it.
Got 5 years for not providing the the encryption key for /dev/random.

Re:Self-incrimination becoming mandatory

[Anonymous Coward]

"You do not have to say anything. But it may harm your defence if you do not mention when questioned something which you later rely on in court. Anything you do say may be given in evidence."

This is basically so that the UK government can comply with the letter of EU / ECHR rights (which guarantee the right to silence) but not the spirit.

Re:Self-incrimination becoming mandatory

[Anonymous Coward]

Furthermore, your silence cannot be taken as compelling evidence against you. The court is entitled to give your silence whatever weight it feels is deserved, when taking all things into consideration. What the court cannot do is to convict you by your silence. i.e.:

Wrong: "She didn't say anything to the police. Of course she's guilty."

Right: "She didn't say anything to the police. On top of everything else I've heard that is just one more reason for me to think she's guilty."

Also right: "She didn't say anything to the police, but I'm still not swayed by the strength of the prosecution's case. I can't convict."

Anonymous Magistrate.

Re:Self-incrimination becoming mandatory

[satyamcomments]

Maybe people should start looking more into steganography to avoid these situations

Re:Self-incrimination becoming mandatory

[TheRaven64]

A Capitol Crime is obviously a crime committed on Capitol Hill. The British equivalent would be a Westminster Crime.

Re:Self-incrimination becoming mandatory

[Phillip2]

I think that you are confusing the UK with the US. The law on self-incrimination comes from the US constitution which is a little out of jurisdiction in the UK.
As for the right to silence, well, that went quite a few years ago. This was probably a bad thing, but there you have it.

Phil

Re:Self-incrimination becoming mandatory

[jabelli]

Yes, but does Alice go to jail for 5 years if she lost the keys? No, because they can just drill the lock. Why should the difficulty of breaking the lock affect your sentence? Suppose they find a key on you, and you refuse to tell what it goes to, or claim to have "forgotten" where the matching lock is? Do you go to jail for 5 years for that too?

Re:Self-incrimination becoming mandatory

[Anonymous Coward]

(Ironically, this is not legal advice. Please see a solicitor if you require legal advice. If you are taken to a Police station for questioning, one will almost always be there on duty, at the very least...)

However, you have the right to legal advice of your choosing first; you cannot and would not be penalised, nor have any inferences drawn, or have any sentencing "credit" removed, for seeking legal advice before answering the questions of the Police.

That is something any sensible person would, and should, do. You have the right to suspend any Police interview until you have legal advice; and if the Police are interviewing you at a Police station under PACE, you would normally have the right to free legal advice.

Re:Self-incrimination becoming mandatory

[Delwin]

Does the UK have an equivalent of the US's 5th Amendment?

Re:Self-incrimination becoming mandatory

[grahammm]

I think they finish with, "do you understand?". I don't know what they do if you say you don't understand.

But as they have just told you that you are not obliged to say anything, you do not have to answer them!

Re:Self-incrimination becoming mandatory

[cortana]

There is no such right in the UK.

"You do not have to say anything, but it may harm your defence if you do not mention, when questioned, something which you later rely on in court."

Re:Self-incrimination becoming mandatory

[rantingkitten]

Wait, isn't this more like police demanding you unlock a door? You can't hide evidence behind a physical lock, so why should a digital lock be different?

Is that true? Can the police demand you unlock a door, even with a warrant? I may be wrong, but I'm not sure they can demand you help them execute their warrant. You just can't get in their way. Meaning, they want access to that secured room, they have a warrant, they're allowed to try to force the door. If they can't, that's their problem. What if you're not around to give them the key, and they can't force the door -- are you responsible for their inability to access the room?

To me encryption is the same thing. You think I have illegal data on my computer and have a warrant to seize the computer. Okay, here it is. I'm not going to give you the key, but you're legally allowed to force it. If you can't, well.. tough. I gave you the computer, anything after that's your own problem.

Someone please correct me if my interpretation is completely off-base.

Re:Self-incrimination becoming mandatory

[Anonymous Coward]

So wait, which is it? Shut your mouth or ask for an attourney? ;)

Re:Self-incrimination becoming mandatory

[Anonymous Coward]

Making encryption a crime makes more criminals.

If you used to do encryption, now you get up to 5 years for that. Might as well add a few much more serious crimes to the list then - it won't add much to it.

Re:Self-incrimination becoming mandatory

[joe_n_bloe]

Turning over evidence in your possession is not the same as testifying.

Earlier this year, a Vermont court found that a Canadian man's refusal to provide encryption keys for data on his laptop was not protected by the Fifth Amendment.

http://web20.nixonpeabody.com/np20/np20blog/Lists/Posts/Post.aspx?ID=298

This really isn't any different than a situation where a witness or suspect is required to open a safe, provide account numbers, et cetera. In general the state can't "fish" for evidence (say, seize a laptop just to see if it contains anything of interest, without a specific goal in mind), but if there is a reasonable belief that a search will produce evidence that pertains to the charges at hand, the state has the right to conduct the search and compel a defendant to cooperate.

You can always refuse anyway.

Re:Self-incrimination becoming mandatory

[Cederic]

Firearms aren't difficult to acquire in the UK.

Other ranged weapons are even easier. I have five perfectly legal ones in the house right now, capable of killing at ranges of up to 20 to 1200 yards (they vary).

Re:Self-incrimination becoming mandatory

[OutOfMyTree]

Er -- what I said was that the defendant should not be able to suddenly and without warning introduce evidence from Mrs Bloggs. Because the prosecution does not have the opportunity to establish that she is not just an innocent old lady who happened to be around but is really Aunt Sadie.

I am sorry, I guess you just haven't come across the idea of an ambush defence before. When you think about it, I think you will agree that it does not improve the quality of justice in our courts. And asking that someone outlines their defence before the trial starts is very different from mandating that they incriminate themselves.

Re:Self-incrimination becoming mandatory

[Anonymous Coward]

It isn't the police who get to decide whether your defence is persuasive, it's the job of the court - either a jury or a bench of magistrates.

Re:Self-incrimination becoming mandatory

[ozbird]

Bear in mind that the State can force Alice to hand over keys in relation to an investigation on Bob, so it's not even a case of prosecuting the guilty, just the forgetful.

Alice my claim she's "forgetful", but that won't fly when the police present the judge with logs showing Alice and Bob were engaged in encryption communications the day or so prior to arrest. There may be situations where you can legitimately refuse to cooperate, but consult a lawyer before "doing a Hans".

Re:Self-incrimination becoming mandatory

[Anonymous Coward]

That is exactly why there is no point talking to the police and why not talking to the police should not count against you.

Re:Self-incrimination becoming mandatory

[__aamzjm3566]

Because whenever they finally decide to call a general election (quite probably as late as possible, given the popularity of the current government), we'll simply vote in the next lot from the other party. Seeing as they seem to pretty much base their policies on each other, we'll probably have one year of 'ooh, aren't things different and better' before the sam incompetence and borderline corruption starts to appear. Now rising up, on the other hand...

Re:Self-incrimination becoming mandatory

[Anonymous Coward]

We don't have a constitutional protection against it in England. It can be a crime to refuse to answer questions of an official (eg. under the Enterprise Act), or to fail to report when you ought to have suspicions about somone else, regardless of whether you in fact do suspect them (Money Laundering Regulations as well as terrorism provisions). And terrorism is indeed *very* widely defined. The prosecution may make inferences of guilt from refusal to answer police questions as well, so the 'right to silence' is seriously eroded.

Re:Self-incrimination becoming mandatory

[celtic_hackr]

Not all safes can be broken into without destroying the contents.

On the encryption key issue, it looks like it's time to implement a new type of encryption.
Here's my idea. This one is like True Crypt. Only a bit more bent.
You have n more encrypted file systems, but n+1 passwords.

When you give the password for the innocuous encrypted filesystem and they aren't satisfied with that, you give them the n+1th password which is a self destruct password that obliterates the true file system. It's a bit extreme, but it's a final solution. But that won't be sufficient, so after activating the n+1th password it becomes a stale password and the system generates a new random password and doesn't give it out. Then, once the PC is powered down it can't ever be accessed again. This will b\prevent them from removing the drive and powering it up someplace else where they can do some deep level analysis on the device to recover the erased data. You could even go further in that once it is in this state it continues to randomly shuffle the data everytime it's powered up.

This may be overkill.

Alternatively, you could have a system that once you've activated the self destruct, it never shows you the actual filesystem, until you insert a stick with an additional password stored in a certain location. Then never have this key on you or in any place that police can get at it.

Of course, if the governments are going to make us criminals for protecting our own secrets that aren't illegal, we could always accommodate them and become criminals. So here's another option, which I really don't recommend, but it should work. Except for me for having divulged it on the internet. Form a dummy company to own your computers, hire some kid off the street as your IT technician. Make sure you don't get his physical description, right name, SSN or address. Using true crypt, and put all the second passwords on a stick. Fire the kid. Report the stick with the passwords stolen. Give the police the information that will never find the kid. Continue to use your computer, and make sure to add new innocuous files into the dummy filesystem. Then when asked for the second password tell them you don't know it and can't retrieve it, because the stick that had the passwords was stolen and you've reported it to the authorities but they haven't caught the culprit yet. You haven't deleted the old filesystem, because you really want to retrieve your valuable IP that is stored in there. They of course will want to verify some of those facts, but you're covered because it really happened, sort of. So now you're guilty of filing a false police report, but at least you won't go to jail for not revealing you passwords. The downside of course it you have to actually lie to the police and commit a crime to protect you from something that should never have been a crime.

People, always think that the 5th amendment is to protect the guilty, but it's not. It's to protect the innocent. For example, someone shots and kills your neighborhood drug dealer (you know who it is - you see the traffic going in and out), while you're out at dinner. You come home just before the police and they begin asking you some questions, about his killing, and somewhere in there they give you a leading question to which you respond "I don't even have a gun". How did you know he was killed by a gun? Then they ask you even more leading questions, to which you say " Hey, I don't even know this guy. I never really liked him." Oh you didn't like him? Motive, opportunity (he's in your neighborhood, knew the means of death. Three strikes, a good prosecutor could rig the right jury to fry you on those bits of circumstantial evidence. I can't take credit for this scenario, it's a hack from some university law professor with a famous video "Don't talk to the Police". Great video, and a must watch for every person alive today. And that my friends is how innocent people get to go to jail, because the system is f**ked up beyond all repair (to paraphr

Re:Self-incrimination becoming mandatory

[RockDoctor]

What's next? Do we remove the right to remain silent?

That went years ago. Maybe a decade ago - I don't remember ; it might have been back before I had a phone line or internet access (pre-1993).

Re:Self-incrimination becoming mandatory

[Anonymous Coward]

The Judge or Jury is already able to draw a negative inference from your exercising your right to silence, the caution here reads

"You do not have to say anything *but it may harm your defence if you do not mention when questioned something which you later rely on in court* anything you do say, may be given in evidence"

Re:Self-incrimination becoming mandatory

[Anonymous Coward]

Actually in the UK you do still have the right to remain silent. Once arrested by the police you are allowed to refuse to answer questions without legal representation present without prejudice to your defence. Once your lawyer is present they should be able to advise you when and when not to decline to answer. Before arrest it gets a little more messy. However you have no obligation to answer any question other than a request to identify yourself. IANAL but this was advice given to me by one when I streaked a sports event and was arrested for doing so. and yes I've posted anonymously as those I work with do not know about my "naturalist" tendency... :-)

Re:Self-incrimination becoming mandatory

[xmvince]

I wonder what would happen if you told them that you actually forgot your decryption password and sat there trying it for a few hours then saying "I really don't know it!!". Could they still convict you?

Re:Self-incrimination becoming mandatory

[L4t3r4lu5]

A little late to reply, but yes it does. You have the right to remain silent.

However, remaining silent can be interpreted openly; You could be silent because you don't know the answer, silent because you have the right to not self incriminate. Unfortunately, it's often the latter which is presumed.

What I want

[petes_PoV]

is an encryption system with 2 keys.

One decrypts the files or filesystem while the other key overwrites the contents with random data.

I would also like to know how the authorities could possibly tell a properly encrypted file from one that only contains random data and consequently how they could prove that a filesystem is, in fact, encrypted.

Re:What I want

[jeek]

Look into the Phonebook filesystem. Not quite what you mentioned, but almost as good.

Re:What I want

[CarpetShark]

I would also like to know how the authorities could possibly tell a properly encrypted file from one that only contains random data and consequently how they could prove that a filesystem is, in fact, encrypted.

There are a few encryption systems out there which provide plausible deniability, and would work something like this (in theory). However, most have pretty clear information, like standard file headers. I've never bothered to actually look at one for encrypted files, but I imagine the file headers essentially say something like "This is a file from APP. It's version X.Y. It's N bytes long. Encryption algorithm is A. Hash method is H. Data follows..."

Re:What I want

[L4t3r4lu5]

I think you're approaching this from the wrong angle.

The issue is no longer whether you can prove their is nothing incriminating in the "ecrypted file" but whether the old memory you've had for 7 months is an encrypted file or not.

Further, TrueCrypt is well known. "Hey, do you have a second 'hidden' partition on this slightly incriminating but pretty inoccuous drive?" "No." "I don't believe you. Do not collect £200."

This is a very, very bad day for the British public.

Re:What I want

[Clairvoyant]

Or just use Plausible deniability, like Rubberhose: http://iq.org/~proff/rubberhose.org/

Re:What I want

[maxwell demon]

For convicting you, they would have to prove that there's a hidden partition.

Re:What I want

[L4t3r4lu5]

That's not an encryption feature, that's an app feature. The application would have to recognise the "destruct" key and wipe the date; The encrypted file wouldn't recognise it automatically.

This is why the most fundamental aspect of forensic computing is "read-only."

Re:What I want

[haeger]

That's assuming that the police are drooling morons that have no clue what they're doing.
Obviously they'll copy the drive before trying anything on it. You hand over the "wrong" key, data gets scrambled, the restore it from the copy they took and asks for the correct key.

Contrary to popular belief the police are quite capable. At least when you get one step up from the patroling officers.

Re:What I want

[Thor Ablestar]

Our Russian law states that the expert should make an exact copy of HDD in question and operate with it, having original HDD intact. British law should have the same provision. So they shall immediately find the self-destruction key and retry.

I sincerely believe that Russia under You Know Who has more freedom than Britain.

Re:What I want

[b4upoo]

And how can they decide if a password has simply faded from human memory? Most people have probably lost a file or two simply be forgetting the password.

Re:What I want

[Anonymous Coward]

If they ask for the password once and don't get what they want they will ask for the second, or third.... while forcing you to hold stress positions... in a third county... while in the spirit of running man asking "is it safe".

By the time they know who you are and where you live its game over.

"If saves just one childs life"

Re:What I want

[petes_PoV]

Yes, I've see systems like truecrypt. However, in this case it's possession of encrypted dfata (and the unwillingness / inability to disclose the password) which is the crime. The only solution is to have an encryption mechanism that is indistinguishable from a block of random data. No doubt, then random number generators will be considered "munitions" and made illegal, too.

Re:What I want

[Anonymous Coward]

You're quite wrong. Most encrypted data is just that: a big binary blob. You are expected to know which program/algorithm/key to open it with. Obviously.

Re:What I want

[PeterBrett]

That's assuming that the police are drooling morons that have no clue what they're doing. Obviously they'll copy the drive before trying anything on it. You hand over the "wrong" key, data gets scrambled, the restore it from the copy they took and asks for the correct key.

This sounds like a good application for a TPM, don't you think? Isn't that supposed to stop anyone being able to remove data from the machine? (Unless the TPM is backdoored...)

Do modern TPMs have a "suicide" feature that allows them to destroy the secret and create a new one on operating system request? If not, they should have.

Re:What I want

[petes_PoV]

Yes, it is. However make the decryption app a part of the encrypted filesystem (or file). That way there can be no third party application available to perform the decryption. The decryption process would therefore be a two-stage affair:
1.) supply one or other of the passwords to the publicly available decryption system
2.) this runs and decrypts something like a bootstrap, which checks the password it was given and either decides to decrypt the rest of the data, or to overwrite it (without ever decrypting it) or otherwise corrupt the files headers.

Now this wouldn't work in cases where the disk was write-inhibited, in a forensic lab. But for situations where the investigator was either stupid/lazy/unaware of the underlying mechanism, the self-destruct would be good enough.

Re:What I want

[Yogiz]

For now.

Re:What I want

[hany]

Aren't they already?

Because, there was a story, that if you look (hard enough) into say Pi, you find your latest favourite Hollywood flick in there somewhere. So DMCA or something similar might be used to forbid you from even possessing a Pi number computed to a big fraction.

I guess (I have to, I do not have mathematical proof) that similar argument can be made also for any big enough random number.

So, RNG generator are not only "munitions" but also a "devices for creating copies of copyrighted works".

note: Yes, I'm joking here. But in some court rooms it might not be taken as a joke. I guess.

Re:What I want

[maxwell demon]

However, in this case it's possession of encrypted dfata (and the unwillingness / inability to disclose the password) which is the crime.

So in the UK it is a crime to possess DRMed media? :-)

Re:What I want

[petes_PoV]

Yes, it's also quite easy to detect. Presumably all you need to do is scan each block and do some sort of correlation function on the data you find there. If the result is that a block shows up as random data AND it's inside a TC. partition, then presume it's a hidden filesystem. Just reapply the thumbscrews until yo get an admission.

Re:What I want

[tsotha]

I've been thinking about that for awhile. You don't want a system that will destroy the encrypted data - as others have pointed out, the cops will image your drive before they do anything, so it's sort of pointless. But I think you could do even better with a set of one time pads. I'm envisioning a system that works like this:

1. You have data you want to encrypt of a certain size. Doesn't matter how large, but you can't really add to it after it's encrypted.
2. You generate a key the size of your original data and xor the key with the data you want to encrypt. If your key is random enough it should be impossible to decrypt. They say you can get something truly random with atomic decay or cosmic background radiation. These days storage is cheap, so having a key as big as a couple gigs should be no big deal - keep it on a fob.
3. Now here's the twist. After you've encrypted your data you generate a second "key" by xor-ing the encrypted data with something innocuous. War and Peace, maybe, or cat pictures from the internet. Now you have a key you can give to the cops if they ever come calling, and the data they come up with will be recognizable as data of some sort. So it will be difficult for them to argue you haven't provided "the key".

Re:What I want

[Anonymous Coward]

What's the problem? Plausible Deniability features solve that.

Re:What I want

[crashumbc]

why even do that? the decrypt program wouldn't need to destroy the data, in-fact that may be illegal itself, it just needs return garbage or "fake" data.

Re:What I want

[Chatterton]

In TC, empty sectors are encrypted too and by that fact undistinguisable from a sector used by the potential hidden partition.

Re:What I want

[Plunky]

Because, there was a story, that if you look (hard enough) into say Pi, you find your latest favourite Hollywood flick in there somewhere. So DMCA or something similar might be used to forbid you from even possessing a Pi number computed to a big fraction.

I understand the technical aspects of this, but I wonder if Pi has been computed sufficently to reveal any actual messages longer than say, a word?

Re:What I want

[sakari]

Actually, for example files crypted with Truecrypt seem only like data, they are indistinguishable from random blabber. Probably.

Re:What I want

[ls671]

There is also systems that duplicate data on empty blocks in the file system.

If you look at the file system, it looks like a normal one, encrypted or not (at your convenience).

The algorithm writes encrypted data in "officially" empty blocks on that file system. It duplicates the data in several spots to make sure the "real" file system doesn't trash the information when it writes files.

All encrypted information kept by those systems is stored in "officially" empty blocks.

So give them the key for your encrypted file system, but keep your sensitive information in empty blocks on that file system. The hidden data is encrypted with yet another key. Keep the software needed to read the hidden data on a flash drive so there is no trace that you are using such a thing on the machine ;-))

And no, if you look at the empty blocks, you won't see: "This is a file from APP. It's version X.Y. It's N bytes long. Encryption algorithm is A. Hash method is H. Data follows..."

Only random data ;-))

Re:What I want

[Znork]

Overwriting the data is pointless; anyone wanting you to decrypt the data will clone the disk before trying out anything you volunteer on it.

Plausible deniability with multiple decryptions is pretty much the only way to get around the rubber hose attack. Give them one key and it decrypts to one thing. Give them another and it decrypts to something else. Put something you might plausibly want encrypted in the first one (pictures of naked cats or whatever would be reasonably innocent but perhaps slightly embarrasing), and the real stuff in the secondary encryption. This could of course be done in multiple layers too, with the end result that they can never know or prove that you have not disclosed the complete key.

Re:What I want

[El_Muerte_TDS]

is an encryption system with 2 keys.

One decrypts the files or filesystem while the other key overwrites the contents with random data.

If they're doing it right they will not mess with the original data, but with a copy. So your idea is quite useless.

Re:What I want

[Godji]

Google TrueCrypt.

Re:What I want

[Anonymous Coward]

Actually, TC volumes tend to fall exactly on 4096 byte borders. Yes, the contents are random and finding anything out about what is inside isn't going to happen, but not that many data blobs have this issue.

Fix: TC should have the option to add 0-4095 bytes to the end of volumes that are ignored by the program.

Re:What I want

[mlts]

That is easily done. A quick search of history of accessed programs might be able to turn up a volume with information in it that is not present on the system.

In fact, most programs have a most recently used list. So, an adversary who looks at the MRU traces would just resume questioning even if the user gave all passwords to any TC volumes on the system.

To get around this, the best bet would be to use TC's decoy OS functionality, where a user can boot the decoy OS, mount the outer volume of partition where the hidden OS is present, and show that the volume is just a large place for storing private files. Using a hidden/decoy OS system ensures that there are no suspicious traces to files.

Re:What I want

[Anonymous Coward]

Elementary misunderstanding. Proof is not required. The doctrine is beyond -reasonable- doubt.

Re:What I want

[Atrox666]

A forensic investigator usually only works from a copy of the machine to preserve the chain of evidence. You're better off using the false partition and hope the cops are stupid (usually works). Another option is to give them a made up password and tell them the file is corrupt. You're kind of grasping at straws at that point. Unfortunately justice has nothing to do with policing and they'll lie, cheat and steal to get a conviction. Technology hasn't changed that.

Re:What I want

[mlts]

This is always discussed on the TrueCrypt forums. Any decent adversary will be pulling out a hardware write blocker and doing their work on an image of the disk in question. So, if the user has a modified TC version which has self destruct functionality, the adversary just rolls back changes, and depending on the civility of the country, either adds another criminal charge, or just chops another finger off their victim (or their travelling companions), and then asks for another key that works.

If you want limited access to brute forcing, TrueCrypt supports smart cards. If someone guesses the password on an eToken too many times, the device will permanently block access, and is resistant to tampering even for well heeled adversaries with a spare SEM at their disposal. If you are confident you will never mistype your passphrase, you can set the maximum wrong guesses to zero, so the smart card would lock after the first try.

Re:What I want

[Anonymous Coward]

Who knows, maybe if we put enough computers in a room with a Pi calculator, they'll produce Shakespeare.

Re:What I want

[Chief Camel Breeder]

If the police can demand a decryption key, then presumably they can legally demand actual decryption. E.g., if you encrypt with an algorithm for which they have no software (maybe one you invented yourself), then I suspect that they can demand that you provide the plaintext, not just the key.

If the police may demand plaintext, then they can probably demand that the plaintext data be rendered into a form intelligible to humans. A non-technical person might not distinguish the decryption from the rendering, and therefore it's possible that the law might be interpreted this way even if the wording is specific to encryption. Therefore any attempt to conceal or destroy the data would be legally equivalent to refusing to provide the encryption key.

IANAL and haven't read the text of the relevant UK act; it may not work like this. But if it does, then anyone with digital archives could be in deep shit. If you have data files you can't read because they're in a custom format and you lost the parser (and that's just about every science department of every university, for starters), then the authorities might consider them equivalent to a refusal to decrypt.

(This is speculative. Please tell me I'm wrong in this conclusion.)

Re:What I want

[deroby]

Random data wouldn't really work as it would get rather 'obvious' as the same file has xyz as contents the first time, abc the second time and pqr the third time you read it.
Overwriting data is stupid too imho, "clearly" they would work on a backup of the data, so when they notice that all data gets overwritten after entering said password, they'll be able to charge you for 'willing obstruction' (or whatever it is called).

Anyway, I'm still confused about this 'right to encryption' so dearly defended by lots of people here.
=> if the authorities have a search-warrant, they are allowed to take pretty much any paper that has something incriminating on it with them. When they ask, you're supposed to open the doors, lockers, safes, etc... so they can get to whatever is behind it. IMHO, same goes for digital encryption. (Sure you could choose not to comply and let them use force to get at it... but if you're 'innocent' I fail to see how that would be beneficial for you !?)

Call me naive, but refusing to give up the keys does make you look guilty any which way you look at it.

Yes I do have locks on my doors too and they indeed come in useful to keep peeping toms out; however when the police knocks saying they suspect my basement to be a meth-lab, well I'll gladly let them in and go look for themselves. Likewise, although I know my neighbour quite well, the moment he refuses police to have a look in his basement for said accusations, my interest will most certainly be piqued and I'm sure the cops' too...

Re:What I want

[tygerstripes]

Actually there is a question mark around whether or not Pi is a "normal number": there was once some speculation that any given block of digits - your phone number, for example - is more likely to appear in the first n digits of Pi than in the first n digits of a randomly generated number.

This would be remarkable if true, but current best-guess AFAIK is that this is false (no proof as yet).

Still, if it is a Normal Number then it is a statistical certainty that every finite or aleph-0-infinite message imaginable occurs as a sequence within Pi, in any base. Kind of an "infinite monkeys, infinite typewriters" situation.

Re:What I want

[Anonymous Coward]

What about Truecrypting a Truecrypt container, both with hidden volumes?

So, Truecrypt1 -> TC1-Hidden -> TC2 -> TC2-Hidden -> Some ideas to patent.pdf (stegged full-length password at end for ->) || another parent container stegged inside a huge image -> super duper secret files to take over world.pdf
You could probably make that a joke as well, then have an actual 3rd hidden container which is just that stegged full-length password reversed and multiplied by Pi.

Re:What I want

[Anne Thwacks]

That's assuming that the police are drooling morons that have no clue what they're doing.

That would explain most of their behaviour. Racism explains most of the rest.

In the UK in the last 10 years, terrorists have killed about 100 people, including themselves. The police have killed about 1,000 people (in car crashes, shooting incidents, or death in custardy) - it is important not to be mistaken for a carpenter or electician in London - and none of them has been convicted of any crime.

Who you gonna fear?

Re:What I want

[toxygen01]

sounds brilliant, only if I had the mod points to mod up you...

Re:What I want

[Migity]

What!? So now we can't export circles?

Re:What I want

[crashumbc]

Yeah, you definitely want it to return the same data every time. Basically, just take a folder and name it "seti raw data" or something, most of the files would be just garbage data files, place your important files in among them, encrypt all the files. When you enter the "correct" key your files appear, when you enter the "fake" key all the files just look like random data files.

Re:What I want

[digitig]

is an encryption system with 2 keys.

One decrypts the files or filesystem while the other key overwrites the contents with random data.

Yes, like the authorities wouldn't take backups first. You've just made your case worse. A duress key might get you further, but probably not.

Re:What I want

[robinjo]

Random data will not do. They'll definitely do a raw copy of the whole device before trying any passwords. Then they will try your key on two different copies and notice, that the data looks different.

Re:What I want

[nmg196]

The authorities only ever decrypt a bit-wise COPY of the original data on a new drive, so there's little point to having another key which "overwrites the contents with random data.". They will never allow a drive to boot up or execute code and often enable the read-only mode of the drive where one exists. If the key you give them fails to work and appears to sabotage their copy of your data, they will still hassle you for the real key.

Re:What I want

[TheKidWho]

The best would be to provide 2 encryption keys, one that when used shows a perfectly normal set of data, and another when used would show the REAL data.

Re:What I want

[vrai]

The police have killed about 1,000 people (in car crashes, shooting incidents, or death in custardy)

Beware citizens of the UK, no organisation that can inflict a custardy death should be trifled with.

Re:What I want

[nmg196]

Isn't that exactly what truecrypt provides? The whole point of the hidden volume mode is to do exactly what you're asking for. I think that's why it was suggested to you. Have a look at their website under the plausible deniability section

Re:What I want

[Anonymous Coward]

Wasn't it "Marathon Man" that had the phrase "is it safe"? "Running Man" was that movie with Mick Fleetwood, Jim Brown, and some obscure Austrian bodybuilder in it.

Re:What I want

[Anonymous Coward]

Modern TPMs definitely do that. If you disable and re-enable encryption under BitLocker, BitLocker scans the boot parts, and passes them to the TPM with the boot volume key to seal up.

One idea is perhaps have an option when a TPM prompts for its PIN to have a duress code which would zero out the stored data. Problem is, if that feature got used, almost immediately, a destruction of evidence charge likely would follow.

Re:What I want

[Anonymous Coward]

If you encrypted it yourself, then sure, maybe.

Re:What I want

[Eivind Eklund]

I have a old machine with a locked disk lying around the house. I have it around because I hope that I will somehow manage to remember the key to it; I used it every day for about year. The disk contains various semi-completed FreeBSD patches, which represent a reasonable of work and would be nice to finish and commit to FreeBSD if I ever get it opened. It does not contain any illegal data whatsoever. However, if I should happen to be accused while in the UK, that disk means that I'd get five years in prison - because I *cannot* give the key to it.

Re:What I want

[metus]

The fact that you're writing again takes a lot away from this idea.

How about 2 keys, level 1 key reveals a partial subset of the encrypted partition and the rest is made to look and work like free space.

You can set some nodes as 'level2' which can only be seen with the other key.

So, You only need read-only access. and if the fs is modified in level 1 mode, level 2 is no longer recoverable.

Re:What I want

[dougisfunny]

I thought Voldemort was British....

Re:What I want

[Vehlin]

That system wouldn't help you I'm afraid. Standard forensics procedure is to make an image of your disk and work off that (to preserve the evidence in the original disk). So if you give them the destruct key they'll just reimage and come talk to you again.

Re:What I want

[Anonymous Coward]

It is absolutely certain that they will - an infinite number of times in fact. It's just that it might take a while.

Re:What I want

[PeterBrett]

One idea is perhaps have an option when a TPM prompts for its PIN to have a duress code which would zero out the stored data. Problem is, if that feature got used, almost immediately, a destruction of evidence charge likely would follow.

It sounds like the trick is to do this in such a way that no-one can tell that anything was changed...

Re:What I want

[zippthorne]

The information has to be somewhere. How does the "primary" partition know not to write to the sectors that the "hidden" partition occupies?

Re:What I want

[RivieraKid]

So basically, "If you've done nothing wrong, you've got nothing to hide"?

That's wrong on so many levels and is basically the reason why governments around the world are becoming more and more draconian in the name of preventing terrorism, or "thinking of the children".

Re:What I want

[Anonymous Coward]

Do modern TPMs have a "suicide" feature that allows them to destroy the secret and create a new one on operating system request? If not, they should have.

Pretty sure they do... there is a "take ownership" operation that clears out the TPM and causes it to generate a new set of keys. Because the old key is lost, the data on your computer encrypted with that key is essentially useless.

Re:What I want

[netwars]

Wouldnt it be better to tell the police that the encrypted data in the last step was actually the key and the new x-ored file was the data. That way they would extract a picture of a cat!.

 

Re:What I want

[mdm-adph]

Then they don't find what they're looking for after they've decrypted it, and continue beating you with the rusty wrench until you give up everything you know. :(

http://xkcd.com/538/

Re:What I want

[madcow_bg]

In TC - by using the second password!

The location of the header of the hidden partition is a hash based on the second password. Thus if you unlock with the first password only, TC doesn't know if there is a hidden one, thus you risk destruction of the hidden filesystem (or some records thereof).

Re:What I want

[grahamm]

Anyway, I'm still confused about this 'right to encryption' so dearly defended by lots of people here.
=> if the authorities have a search-warrant, they are allowed to take pretty much any paper that has something incriminating on it with them. When they ask, you're supposed to open the doors, lockers, safes, etc... so they can get to whatever is behind it. IMHO, same goes for digital encryption. (Sure you could choose not to comply and let them use force to get at it... but if you're 'innocent' I fail to see how that would be beneficial for you !?)

I do not think it is the same for encryption. With papers, if the writing on them is in code then they have the physical paper but not access to the information written on it. Similarly with digital encryption, they have the physical zeros and ones but cannot understand the meaning. Forcing you to decrypt the digital data is more like forcing you to decode written documents than forcing you to open a locked filing cabinet or safe.

Re:What I want

[chrb]

There is no difference between a block of random data and a block of well encrypted data - that's the whole point. But I imagine that if you have a 100GB random file or partition on your hard drive and there is wire intercept or some other evidence against you (which, hypothetically, there should be, otherwise there would be no court order to seize your hard disk), then the courts will assume it's an encrypted drive.

In most cases, people using encryption software will have that software installed, and configured to rapidly open the drive (otherwise they'd have to set up key size, encryption type, etc. each time they open the drive). Also, most encryption systems don't just hash the password to produce the block cipher key - they need initial vectors etc. and then decrypt those with your password hash. This data has to be stored somewhere. If you really wanted to, you could hard code all the settings into the source before compiling, so there is no runtime config apart from specifying the password.

Re:What I want

[Flea of Pain]

Who you gonna fear?

Ghost busters?

Re:What I want

[Hatta]

Call me naive, but refusing to give up the keys does make you look guilty any which way you look at it.

Refusing to testify in your own trial makes you look guilty too, but that's a right we all have.

Re:What I want

[Hatta]

Further, TrueCrypt is well known. "Hey, do you have a second 'hidden' partition on this slightly incriminating but pretty inoccuous drive?" "No." "I don't believe you. Do not collect £200."

What this means is that if you run Truecrypt, they can send you to jail, even if you honestly do not have a hidden partition. There's no way for you to prove that there is no hidden partition. Anybody running Truecrypt in the UK could go to jail for this reason.

Re:What I want

[Anonymous Coward]

I would also like to know how the authorities could possibly tell a properly encrypted file from one that only contains random data and consequently how they could prove that a filesystem is, in fact, encrypted.

There are a few encryption systems out there which provide plausible deniability, and would work something like this (in theory). However, most have pretty clear information, like standard file headers. I've never bothered to actually look at one for encrypted files, but I imagine the file headers essentially say something like "This is a file from APP. It's version X.Y. It's N bytes long. Encryption algorithm is A. Hash method is H. Data follows..."

This is the most silly thing I have ever heard.

The whole thing about plausible deniability is there is no headers or anything; if u got the wrong password or algo; you get the wrong result.

Seriously; how can you even THINK that somethng designed for "plausible deniability" will give the whole thing away by "file headers"?

"no part of the (dismounted) hidden volume can be distinguished from random data"

"Note that TrueCrypt never modifies the filesystem (e.g., information about allocated clusters, amount of free space, etc.) within the outer volume in any way. It is not possible to determine whether the volume has used hidden volume protection or not. "

etc

Re:What I want

[cdfh]

Call me naive, but refusing to give up the keys does make you look guilty any which way you look at it.

Yes I do have locks on my doors too and they indeed come in useful to keep peeping toms out; however when the police knocks saying they suspect my basement to be a meth-lab, well I'll gladly let them in and go look for themselves

How about when the police knocks on your door asking to see your meth-lab, which is in fact your super-secret fantasy basement, complete with props for you sexual fetishes and evidence of your deviant fantasy of wanting to be your own mother?

The above is not against the law, but you might rather die than have your friends/relatives know about it. Also consider if the basement was the HQ of a (perfectly legal and moral, etc) secret anti-government organisation. While not illegal, I'm sure you would rather the police did not know of its existence.

Re:What I want

[kniLnamiJ-neB]

When my time comes, I can't think of a better way to go... death by custard. At least I'd die happy...

Re:What I want

[chrb]

You are right, the Trusted Platform Module can verify the boot process, and only provide encryption key service if the mainboard and harddrive and software are the same. However, it is unlikely to be possible to succeed with a TPM wipe - if the forensics lab is any good they will attach something to the bus that the TPM chip is on to intercept any possible wipe commands. Of course they will still back up the hard disk on another PC first. With software drive encryption they can rip the key out of the DRAM with hardware while it's powered up (and even for hours afterward if they can cool the DRAM before power off, see Felten's attack), so TPM doesn't help if you are forced to hand over your password.

Re:What I want

[jockeys]

sounds like those 1,000 people got their just desserts.

Re:What I want

[misexistentialist]

If you encrypt something, obviously you don't want it public. It might not be a terrorist master-plan or child bestiality but it might be embarrassing copro-porn, love letters to your college girlfriend, pictures of yourself cross-dressing, etc. If you knew that these items could be public you would not have them, and would restrict your life out of fear. Similarly, if you were expected to let the police look in your basement whenever they wanted, you wouldn't ever light up a joint in your house, you wouldn't walk around your house naked, hell you wouldn't cook dinner because the police would probably just interrupt. Freedom means the right to be left the fuck alone, and I expect even you would come to understand this if the cops were uproariously laughing over your action-figure display during their daily inspection of your basement. When you have to do whatever the cops say out of fear that you'll look guilty if you don't, there is no law, and you are a slave.

Re:What I want

[Anonymous Coward]

you're naive

Re:What I want

[Nitage]

Nice idea, but it doesn't work. You've turned the problem from "How do I encrypt X bytes of data in a deniable way" to "How do I hide a file X bytes long". In other words, for your scheme to work, you need to disclose your 'fake' key and hide your 'real' key - but your 'real' key will be the same size as the data you were trying to protect, so if you could reliably hide that data then you wouldn't need encryption.

Re:What I want

[Gunstick]

LOL, so you effectively give them your data saying it's the key so they can use it to decrypt the key which they think is the data and they get War and Peace. Funny.

Re:What I want

[Gunstick]

> you can set the maximum wrong guesses to zero, so the smart card would lock after the first try
And write a wrong password on the card itself, so the chance that someone will just try that are quite good :-)

Re:What I want

[Anonymous Coward]

Just use a PRNG to generate the OTP. Now you only have to memorize the random number seed for the PRNG that will generate your OTP.

Re:What I want

[RemyBR]

Destroying the data if a secondary password is provided (or by any other "trigger") will not have any effect once your data/media is not with you anymore. The first step in any forensic analysis is to make a copy of the data, preserve the original and work on the copy. So if you screw it and destroy anything you can just revert to the original and start over.

Re:What I want

[Pascal Sartoretti]

What this means is that if you run Truecrypt, they can send you to jail, even if you honestly do not have a hidden partition. There's no way for you to prove that there is no hidden partition. Anybody running Truecrypt in the UK could go to jail for this reason.

This is why we need TrueCrypt to be installed by default on as many Linux distributions as possible. Hence, the single fact of having TrueCrypt installed on your machine will not be anymore a hint that you use it.

Re:What I want

[mr.mctibbs]

I can't tell if this is a troll or not. Maybe it's different in the UK, but I don't think it would be possible for a competent officer of the law to inspect my home, my vehicle, and my computer without coming away with something that could be used to prosecute me for a crime. Here are the rules you follow to avoid being arrested, *especially* if you are innocent: 1. You don't talk to the police. 2. You DON'T TALK TO THE POLICE. 3. Get a lawyer. 4. Do as your lawyer tells you. Rules 1 and 2 dictate that I will say absolutely nothing. Can they prove that I formatted that drive with encryption? Maybe one of my geek friends did it. Maybe there was a password at some point, but maybe I don't remember, or never even knew it in the first place. Until you open your mouth they have to prove it from the ground up. The federal government has zero right to what's in your head. Any government that would leverage your freedom against your knowledge in order to incriminate you deserves some civil disobedience.

Re:What I want

[Hatta]

That just opens any Linux user up to jail time. They don't even care whether it's actually encrypted data or just random data.

Re:What I want

[Kjella]

note: Yes, I'm joking here. But in some court rooms it might not be taken as a joke. I guess.

I think it falls into the "make a bomb joke in front of the TSA" class...

Re:What I want

[Anonymous Coward]

Yes I do have locks on my doors too and they indeed come in useful to keep peeping toms out; however when the police knocks saying they suspect my basement to be a meth-lab, well I'll gladly let them in and go look for themselves. Likewise, although I know my neighbour quite well, the moment he refuses police to have a look in his basement for said accusations, my interest will most certainly be piqued and I'm sure the cops' too...

Even though you feel you have nothing illegal in your basement you are still allowing law enforcement the opportunity to incriminate you for any and all possible breaches of any law. They may arrest you for something unrelated to a meth lab or hold you on charges or suspicion of a meth lab because you may have violated 1 of probably greater than 10,000 laws.

Re:What I want

[sanosuke001]

You SHOULD gladly ask them for a warrant, not gladly let them in. I assume you implied this in your statement, but it is a very important step. Asking to see a warrant should not make you look guilty; it is your right. Unfortunately, it probably does anyway.

Re:What I want

[hoggoth]

This article is just full of "clever" ideas from people with no idea how forensics work.
The forensic investigator will be working off a clone of your hard drive, not the original.
Overwriting the encrypted data with random data will show the investigator exactly where your precious data is stored.
He will then make a new clone and get to work on the data that was overwritten on the previous attempt.

Re:What I want

[Anonymous Coward]

Very good.
So the police comes knocking demanding your encryption keys.
Sure you say, delivering them.
They decrypt your files, finds nothing interesting and then demands the "other" key that decrypts the "bad stuff".
You have no such key so you say. "Sorry officer. Don't have one of those".
They say "Sure you do. Hand it over or you go to jail for 5 years.".

Now what?

Re:What I want

[Pascal Sartoretti]

That just opens any Linux user up to jail time.

Including the French police ? See this

Re:What I want

[downhole]

Doesn't sound workable to me. Your premise is that you can hide a memory stick of some sort with a lot of data on it. If you can do that reliably, why not just put the hidden data in the clear there instead of messing around with complicated encryption schemes?

Re:What I want

[trunicated]

(Sure you could choose not to comply and let them use force to get at it... but if you're 'innocent' I fail to see how that would be beneficial for you !?)

If I'm innocent, why not just let the government put cameras in my house and monitor them all the time? I mean, if I'm not doing anything illegal, I've got nothing to worry about, right?

Terrible argument... just terrible...

Re:What I want

[Anonymous Coward]

I think you meant "just deserts".

Re:What I want

[FutureDomain]

Why go to all that trouble? Don't have any headers, or fake data at all. Have just the data and decrypt it whether it's the right key or not. You'd have to specify the encryption algorithm, hash, etc when mounting it, but it would also have the effect of returning garbage if the key or algorithms were wrong. Right now, Truecrypt has an encrypted header that decrypts to "TRUE" when using the right key and algorithm and pops up an error if it doesn't. But under this system, the data is decrypted successfully regardless of whether the key is right or not. If the key is correct, it returns the encrypted data, if it isn't then it returns garbage. The only major downside is that you would have to decrypt and reencrypt the entire container just to change the key or algorithm.

Re:What I want

[FutureDomain]

Beware citizens of the UK, no organization that can inflict a custardy death should be truffled with.

There, fixed that for you.

Re:What I want

[Anonymous Coward]

You fixed it by making it less funny? Wow, thanks.

For future reference: trifles contain custard, truffles do not.

Re:What I want

[Anonymous Coward]

There is a problem in that TrueCrypt and other programs have the hidden volumes inside of regular volumes. So if you use TrueCrypt to encrypt your sensitive but innocuous documents (like bank statements or you and your wife's sex tape) without using a hidden volume, you have protected your information from the neighbors. However, the police come in, you give them the key. They decrypt the volume and find nothing about crime X. Then they go crying to the courts saying that you are not giving the key to the hidden volume. They show what evidence they have that you committed crime X and that you did not fill the volume and therefore you must be hiding the key to the hidden volume. *BAM* You're in prison.

Re:What I want

[sabt-pestnu]

when the police knocks saying they suspect my basement to be a meth-lab and have an appropriate search warrant, well I'll gladly let them in and go look for themselves

With the correction, I would agree with you.

And the same should hold for encrypted data. Because they suspect me of doing a particular heinous act should not mean that *every* passcode in the house know should be made available. What, they want to see, perhaps, if my Death Knight has illegal drugs?

Re:What I want

[Anonymous Coward]

the moment he refuses police to have a look in his basement for said accusations, my interest will most certainly be piqued and I'm sure the cops' too...

Yeah sure. As for me, when the police knock to search my basement, I ask to see a warrant. What the hell is with people and the 'Well, if you refuse you must be guilty' mindset? Did I step into the twilight zone recently? If your doctor shows up to your door at 1am with a colonoscope, are you going to let him check for cancer at his whim?

Re:What I want

[Anonymous Coward]

I agree that refusing to hand ou the key makes you look like you have something to hide from the authorities.

But picture this: imagine that no single entity has the tools to open the door to your basement, except you, because you have a key. If the police asks you, you can open the door and show them that there's nothing illegal in your basement. But if you ever lose that key, you're headed to jail. That's one problem with this law.

And now imagine that you do have something illegal in your basement, something that could throw you in jail for 10 years. Would you open the door, or just say you lost the key and spend no more that 5 years in jail? That's another problem with this law.

Re:What I want

[Urza9814]

Yea, sure. Then they start wandering around other parts of your house and looking at other things (or even just looking at things on the way there)...if you happen to live in, say, Oregon, they walk through your kitchen and catch your wife wiping dishes dry and arrest her. (http://www.associatedcontent.com/article/24074/stupid_but_real_laws.html)

My point being: Nobody - not you, the cops, your lawyer, or your elected representatives knows every single law. And there are a lot of really stupid ones out there. So why should you cooperate with the police when they could just turn around and arrest you for something else?

Or you could always end up with a crooked cop who will either frame you for something or trash your house...

Or the 'cop' could be an impersonator who, once inside, will kill you and rape your wife and kids.

Re:What I want

[skeeto]

Overwriting data is stupid too imho, "clearly" they would work on a backup of the data, so when they notice that all data gets overwritten after entering said password, they'll be able to charge you for 'willing obstruction' (or whatever it is called).

Exactly right. A self-destruct key will only be as effective as DRM: barely effective at all.

if the authorities have a search-warrant, [...] When they ask, you're supposed to open the doors, lockers, safes, etc... so they can get to whatever is behind it.

Nope, not in the US anyway, though the warrant may give them permission to break into those things, possibly destroying them.

however when the police knocks saying they suspect my basement to be a meth-lab, well I'll gladly let them in and go look for themselves.

Then you are a fool. Helping the police like that can't help you, and can only hurt you. If you don't have a meth-lab down there, then the police have no business being in your home, so you don't allow them in. It's a matter of privacy, so stand up for you rights. Complacency aids abuse.

You're argument here can be summed up to "if you've done nothing wrong, you've got nothing to hide," which is extremely naive.

Re:What I want

[Anonymous Coward]

You assume the authorities can be trusted. There are many places in the world were you can't!!

What if they have a search warrant to look for "A" and you have confidential information encrypted on "B" which for what.
ever reason you don't trust the authorities to see. This information doesn't need to have to have to do anything crime.
There are many kinds of confidential information (medical records/personal information/other) which people have a good reason
not to share to anyone.

You might just not trust the enough to not leak your data to a news paper or someone else.

Re:What I want

[CarpetShark]

You see, it works like this: after the full stop (or period), it's a new sentence. You don't just keep reading as if the same subject is being discussed.

Re:What I want

[migla]

What if you're not guilty at all and all you have is encrypted holiday shots (of you and the spouse, not looking like mr/s universe on the beach) or something else that might be embarrassing?

Yes, one might look guilty when not volunteering the keys, but so what? How far down this slope should we slide?

In fact, you seem suspicious to me. Wouldn't a terrorist say s/he has nothing to hide?

Re:What I want

[deroby]

Maybe it's naive, but from a practical point of view : what good would standing up for my rights bring me here ?

Re:What I want

[deroby]

And why again did you decide to encrypt those patches-in-progress ?

Re:What I want

[deroby]

I am most certainly not in favour of this law, something quite a few people somehow seem to deduce from -my obviously badly written (*)- post.
Given the way eg. TrueCrypt works, simply having it on your machine seems to be enough to "make" you guilty by this law and indeed that is plain silly. That said, simply don't install TrueCrypt and use something less technically perfect like the NTFS encryption or simply a 7-zip archive with a password.

As for the risk of me knowing I'm innocent but "the cops" likely to arrest me for something totally unrelated : when did things become so much us vs them? I'm in Belgium here, and although I'm very willing to believe there are some *ridiculously* stupid laws around, I doubt an investigator in search of illegal druglabs will enjoy the paperwork to fine me because I painted a wall in the wrong colour.

Call me naive *and* dull (**), but I do doubt there is that much around my house that could get me arrested. Crime units have enough on their hands already besides harassing 'ordinary citizens'. Citizens that refuse to cooperate might off course be another matter... in fact, when people simply enjoy counter-acting law-enforcement as a hobby (and yes, that's what some of you make it sound like), then they're simply wasting time and tax-payers money (and hence mine too!) so frankly I wouldn't mind too much. If on the other hand you have the impression law-enforcement is stepping outside the boundaries of what they rightfully can and should do, then go by the proper channels to make these things public and fight them accordingly. Imho, public disobedience should be, maybe not the last resort, but certainly not the first one either.

Frankly, I'm more against this need to encrypt and 'make everything secret' in the name of privacy that seems to be the general tenure here (lately). It's all too black and white here for some ... No I'm not saying one has to crawl for every guy waving a badge in your face but no there is no need to go berserk about them wanting to check how 'an anonymous tip' turns out, especially if they good reason to follow that lead and have gotten the relevant paperwork which means they already internally scrutinised this. If we take away all their power to investigate, there won't be much crime-fighting left. Then again, if we give them too much power, or more precisely, if we give them too much STUPID tools (eg. like this law here) that can be used as a wild-card against whomever happens to be in the wrong spot, then there will be less actual crime-fighting too. It's all about finding that sweet-spot in the middle.

(*: Yes, I would let them in without complaining *if* they have the proper warrant, apparently that wasn't too clear either, mea culpa)
(**: no I don't have pictures of me cross-dressing, nor a sex-tape of my wife ... in fact, who has all these things to start with and then again, if you're scared to death they'll be found : destroy them and live your life without that stress... Man, the situations people like to put themselves in sometimes make me wonder ... )

Re:What I want

[skeeto]

It's not even practical because letting them in doesn't help you at all, but it can potentially get you into real trouble. The cops might see something illegal/suspicious that you didn't even know was illegal, or maybe some friend of yours stashed drugs in your home and you didn't know (that happened to someone I know, but with his car, and it cost him his job). You don't have to prove your innocence, they have to prove your guilt. So in this situation you are much safer standing up for your rights. It's good in the long term and the short term. And, on a lesser note, you also aren't wasting your time, and their time, showing them around.

This was linked by someone else too: it's a lecture by a lawyer and a cop about why it's a bad idea to cooperate with the police more than is required to by law. Dont Talk to Police. The video is probably worth reviewing once a year.

Re:What I want

[Anonymous Coward]

Obviously they'll copy the drive before trying anything on it. You hand over the "wrong" key, data gets scrambled, the restore it from the copy they took and asks for the correct key.

They'll also slap you with an additional charge of tampering with evidence. You'd also be shooting a massive hole in your defense: Most people are going to reason that, if the data isn't hiding something at least as bad as the cops say it is, you wouldn't have tried to destroy it.

I imagine your best bet is to "forget" the password to an encrypted file that bears no evidence of having been accessed for years. That is, the "I forgot" defense isn't going to fly if the file appears in your recent documents list and is timestamped for last night. :P

Re:What I want

[Eivind Eklund]

Because I was using it as a workstation. This means that it included my SSH keys and client documents, and I wanted to keep it secure from physical compromise.

Now, I worked as a security consultant at the time, so it at various times included data such as network layouts for clients, incident response plans for financial institutions, new vulnerabilities that could be used to trick an online banking system, and so on, so I could possibly have used that to demonstrate that I had strong reasons to encrypt that disk.

However, even before I started working as a security consultant, I had a habit of tightly securing machines, and I still tend to be fairly careful. And I know people that are paranoid about it - to the level where it could be considered clinical. That's not enough that they should be put in prison if they also have a lapse of memory.

Re:What I want

[Jamie Lokier]

It's not convincing, because you can generate that fake key with any kind of encrypted storage after the police have imaged your encrypted drive.

After they ask for a key, you fetch kitten pictures from the internet, and xor that with the drive image they have copied, and give them the result. They apply it using your suggested decryption algorithm - xor - and kitten pictures appear.

But it's too easy: anyone can do that, no matter what encryption scheme they've been using prior to the police raid, provided the person still has a copy of their encrypted drive.

So the police won't be convinced.

Re:What I want

[tsotha]

But it's too easy: anyone can do that, no matter what encryption scheme they've been using prior to the police raid, provided the person still has a copy of their encrypted drive.

I don't think this is true. With all the commercial encryption schemes I'm aware of you will be unable to produce anything that looks like unencrypted data without the real key. Indeed, that must be true for brute-force codebreaking to work.

Also, if you're in the position of having the cops demand the key do decrypt some of your data, it's highly unlikely they're going to give you access to the encrypted data.

Re:What I want

[Jamie Lokier]

You missed the point.

Using the GP's scheme, you can produce any data you want, by supplying a "key" which happens to be the same size as your drive and is the XOR of your drive's encrypted image, and the data you wish to make it apparently reveal.

I agree that you probably won't have access to the encrypted image and probably won't have a backup of it (with the exact same encryption).

At first that appears to make the GP's principle of preparing the "reveal kittens" fake key in advance make sense.

But to do that, you have to continuously update your fake key in it's secret location each time you write to your encrypted disk, which is no less effort than simply copying all writes elsewhere - except it gives a slight hint of plausible deniability in that there are two different things, and each serves as a "reveal kittens" fake key for the other.

XOR is too simple of course, but there will be other schemes which bear greater resemblance to real encryption and have the same properties.

Can I ask..

[eexaa]

...if you lost or just really forgot the decryption key/passphrase, would it count as refusing?

Re:Can I ask..

[FluffyWithTeeth]

Obviously, yes.

Re:Can I ask..

[FinchWorld]

Carefully crack a CD in various places, so that not data can be recovered from it, scrawl on it "Encrytion Keys - Keep Safe" and hide in a stack of CDs.

When arrested, tell them about this CD that has your keys. When they come back and inform you its damaged go psycho screaming at them for having lost your keys, and hence, years of data (cos your back ups are encrypted too right?).

Sue.

Profit!

Ok maybe not, worth a thought though.

Re:Can I ask..

[Anonymous Coward]

As with toasted HDs, you'd be surprised what can be recovered from cracked CDs.

Re:Can I ask..

[ledow]

If it got to the point where you're in court, they will happily pay the £1000 or so that it would cost to read even a cracked CD. And when they found it was blank, they would impose a harsher sentence for lying in the first place.

It's much harder to "destroy" the entire CD that just cracking it. You would almost literally have to set it on fire in order that they couldn't say "well, we recovered 90% of the data from the various shards and found nothing but zeroes".

Re:Can I ask..

[Anonymous Coward]

It is obviously not obvious.

Re:Can I ask..

[sakdoctor]

What if, what if, what if...

No cute little work-around is going to help, because the RIP act was designed as a tool of authoritarianism.
Recently in historical terms, encryption has became essentially unbreakable, and this is the backdoor to it all.

Re:Can I ask..

[Yogiz]

You can always write a single text file containing something that looks like encryption keys and then when they discover that none of the keys work, you can say that they have corrupted the disk. Whatever, write a corrupt disk in the first place. I have a half-broken cd-writer that writes half broken cds all the time.

Re:Can I ask..

[Anonymous Coward]

"well, we recovered 90% of the data from the various shards and found nothing but zeroes"

Easy enough to fix. You just need to have enough random data on it to make it look as if there was something there.

Re:Can I ask..

[91degrees]

No.

Although it would probably help to have some sort of plausible evidence that you no longer have the key.

Re:Can I ask..

[YeeHaW_Jelte]

So? Don't use an empty CD but one with the actual keys. Flip a bit somewhere in the keys.

If they try to decrypt your drive with the key and fail, blame the recovery process.

I think they'd have a pretty hard time proving that the recovery of the keys from the damaged CD was 100% correct. They might get so far as to make it probable, but I know if no way to prove it 100% accurate without the original data to verify it with.

Hmmm, maybe I shouldn't have posted this ... if they find this message and link it to an IP I frequently use ... /me engages in paranoid episode.

Re:Can I ask..

[zmooc]

A friend of mine actually pulled that off. He had all his data properly encrypted and had the keys stored as a note on his phone. When he was arrested, the cops handled the phone so roughly that the keys were unrecoverable. Probably saved him a lot of trouble;-) And it saved him from having to walk around with that incredibly ugly phone any longer too:P

Re:Can I ask..

[Mhtsos]

Well, better burn the goatse.cs image on the cd before you crack it then

Re:Can I ask..

[iworm]

No mod points. So here to say to you "Spot on". Totally and completely correct.

Re:Can I ask..

[Anonymous Coward]

If a single bit is flipped in the key, and they are a little intelligent, it will be quite easy to try all 1-bit flipped variations. The possibility of having multiple bits simultaneously flipped is gets lower each time they try more permutations.

In other words: they should be able to recover partially corrupted keys, and if they can't recover it in such a way, it could be argued that this was not the original key as it would differ too much from it to be seen as an accidental corruption. So this is not the proper way to do it.

Corrupting bits on the drive gives an even more unlikely scenario, as a corruption in typical CBC-encryption only affects up to two blocks ahead. Testing the keys on the headers can go wrong, but there is plenty of other data which they can test keys on to attempt to get something which looks "nonrandom". Once they have the good key, they will recover partial data from a corrupted disk.

Of course, none of these methods are failproof. But usual evidence never gives 100% confidence, the judge only has to decide whether the scenario you present is plausible.

Re:Can I ask..

[auric_dude]

Towards the end of the last millennium Ernst Saunders used the "suffering from Alzheimer's Disease" line of defence http://en.wikipedia.org/wiki/Guinness_share-trading_fraud and although still found guilty his sentence was halved upon appealed. I do not think it would work now days.

Re:Can I ask..

[Prof.Phreak]

so use a microwaived thumbdrive; put actual (fake) encryption keys on it before putting it in a microwave. If you can't read it, "you just broke it!" if they can read it, it has keys that don't open anything ("but those -are- my keys. you must have wrong/planted files.").

Re:Can I ask..

[mad_minstrel]

Here's a better idea: Get an internal PCI RAM drive. Store the encryption keys there. They come in, seize your equipment, unplug the computer, POOF, it's gone. And they were the ones who did it. And the best part is, the encryption key doesn't even have to be there, the one in your head is fine as long as you have plausible deniability.

Re:Can I ask..

[AlexiaDeath]

How do you think would be possible to read a disk that has a scratch with surface missing? Keys are binary data. if they cannot be restored, there is no way of knowing if they are correct ones.

Re:Can I ask..

[Darth_brooks]

Recently in historical terms, encryption has became essentially unbreakable [wikipedia.org], and this is the backdoor to it all.

Score -1: Wrong.

*Brute force* decryption has reached a point in *some cases* where it has become pointless. In other cases (say, a four digit pin) where it's still a perfectly acceptable solution.

My half-assed crack pot theory is that genuine decryption has long since followed the same path that password cracking has moved towards. Rainbow tables. Rather than trying to break open one particular key, or dedicating the resources towards generating all possible keys, just do a hybrid dictionary / rainbow tables / brute force attack. Use those terra-exo-giga-uber-flop beasties to generate all possible keys, but work your way down from most probable to least probable. What's the point of quintuple DES 8192-bit Blowfish double ROT-13 with a cherry on top encryption if you're going to use 12345 as your decryption passphrase?

Anything that involves a passphrase is inherently weak. The end user will always be the weak link. Unless you're into burying USB sticks with PSK's in the backyard, thinking that your data is secure just because 'it's encrypted, and xyz encryption is unbreakable!' is a fallacy.

Re:Can I ask..

[ledow]

Because that scratch isn't the entire CD?

Reading past a "scratch" is actually designed into the error correction of all CD's... if my Coding Theory course serves me correctly, it could survive something like 600 consecutive binary errors (and less random errors) in each kilobyte on the actual disk without actual data loss. Plus you have to identify the exact sector where your key resides, and scratch/crack through it in an "accidental" way, which obscures the key such that it isn't at ALL useful for decryption (every a small subset of the key would cut the amount of brute-force required substantially), but such that if a key IS discovered (elsewhere in the PC) that you can say "see, that disk did have a bit of it but it was scratched" rather than "Ha, ha, that wasn't the key, is was random data/blank/modified".

Playing "let's mess about" with the law by using the latter tactic isn't at all useful when charges of perjury, obstructing the course of justice, etc. are added into the mix - you'll do more time for them then you do for failing to reveal your key if it's suspected that you did it deliberately. If you do this for the scenarios described, you better be DAMN sure that you obscured the real key in a way that make it more difficult to read (which is basically impossible... even a few consecutive bytes of the key would help immensely - each bit of the real key they have cuts the key-search brute-force time by a factor of 2, I should think) and you'd be more likely to be giving them a lot more than that by playing such games.

Never store the key, destroy the key entirely upon discovery or store the key securely and give it to them. Don't faff about by coming up with fancy obfuscation techniques for a key that "appear convincing"... computer forensics teams can just read the pits off the worst of CD's and reconstruct enough of the key to make it a waste of time - they know a blank CD from a real CD, they know how to reconstruct the error-correction algorithms (probably with a greater degree of success than your CD-reader does - I wouldn't be surprised if a decent mathematician couldn't use the knowledge of a badly-damaged bit-stream that has some form of error-correction, even if insufficient to reconstruct the data, and put it to good use in limiting what keys, etc. to check), they might even be able to pick up on "deeper" forensic evidence on the CD's pits (e.g. burnt slightly larger than need be, CD's that are unreadable on any CD-reader, or previous overwrites of a CD-RW). It's all a question of effort, and if terrorism is involved, you just KNOW they think it's worth the effort.

And if your key is discovered by other means (e.g. they spend 2 years trying to crack it while you're inside on other charges) and doesn't match the one you "claimed" was the key... that's gotta mean you don't get out for possibly decades.

Re:Can I ask..

[Shakrai]

Unless you're into burying USB sticks with PSK's in the backyard, thinking that your data is secure just because 'it's encrypted, and xyz encryption is unbreakable!' is a fallacy.

That would be a very bad idea. It's generally accepted in the US that if you write the password down somewhere and the authorities find out about it they can subpoena the writing. Failure to comply with the subpoena would result in a contempt of court citation and jail time until you complied. I would assume the same would apply with a USB stick.

It's much better to ensure that the password is only stored within your head. Using diceware you can come up with an easy to remember password that has enough entropy in it to be secure against brute force attacks.

Re:Can I ask..

[cdfh]

Why use the original key at all? They have no idea what the key looks like, so a random key is just as plausible as the original key (which obviously should have been random when it was created).

Re:Can I ask..

[Gunstick]

with truecrypt you can use keyfiles which can be any binary data additionally to your key. So in that case the password effectively becomes pure binary and bruteforce is impossible. You would need to know which of those 1000 files is the keyfile. Of course stored on a FAT filesystem so there is no last access time available.

Re:Can I ask..

[mulaz]

AFAIK Truecrypt can use a 'normal' file as a key. So you can actually use a 700mb file as a key. So.. 1) Burn 700mb of random data on the cd 2) make a HUGE scratch (just one) that destroys the foil on the cd 3) put the cd in a spindle with other cd's and something that could've caused that scratch in between (metal shaving, etc) 4) ??? 5) profit Recovering full 700mb should be hard enough for them too. especially with random data, where they cannot predict the missing data. And with a file so large, the 'missing' part will be large enough to make brute-forcing useless.

Re:Can I ask..

[iivel]

Forensic investigations typically will copy contents of memory prior to powering down.

Re:Can I ask..

[Kjella]

Not saying that you're wrong either, but look at it the other way - since when has people been able to make unbreakable containers and unbreakable communication? Yes, encoding it in various ways date at least a few thousand years back but then you could always find en/decoding rings, code books, in more recent times like Engima you could find en/decryption machines and so on.

Borders and customs in practise don't exist for digital information. I could "smuggle" an image through every country in the world over ssh and noone would be any wiser. You have to admit that without the RIP, the police are worse off than they were in the days of letters and POTS and locks made of steel. Things have become literally very binary, either it's too easy or impossible.

Re:Can I ask..

[TheRaven64]

Depends on the CD. CD-Rs have the data written on the top layer, which is unprotected. If you scratch this - which is easy to do by accident if you write on it with a ball-point pen - then the file is gone for good because you've destroyed the substrate on which it's stored.

Re:Can I ask..

[Bitmanhome]

Hmmm, maybe I shouldn't have posted this ... if they find this message and link it to an IP I frequently use ... /me engages in paranoid episode.

Wait, you wrote this *before* you posted. Is this a temporal paradox? I'm confused.

Re:Can I ask..

[Anonymous Coward]

The encryption key is only going to be a tiny amount of data compared to the capacity of the CD.
The cracks will no doubt damage a big enough part of any key to make it unusable.

Re:Can I ask..

[Anonymous Coward]

Done and done =).

But instead of using cd I used a already damaged floppy disk, saved "keys" to it and checked that fs index was okay but the keys were unreadable. When they told me that the floppy was damaged I cursed that all my data is lost and asked them if they had broken the disk.

This happened in Northern Europe.

There was nothing incriminating at my hd's but I wanted to keep my privacy, I did not want the perv cops to look at my photos (including my wife ;) etc.

To be precise I did not use a real floppy disk, real floppy disks are those really old 5' disks which bend in every direction, hence the name "floppy".

I think that it's good to have /, /var/logs, /var/logs/proxy/, /home, /work etc. on different partitions and encrypted with different keys. This way you have control over where the coppers have access. In my case I needed the computers back ASAP and letting the cops to look at / and /var/logs was the key to prove my innocence and get the machines back. Of course these partitions key-floppies worked but the other one did not. I had two floppies, other was good and other was broken.

That's rich

[CarpetShark]

There is uncertainty in that the names of the people convicted were not released

That's rich. The government convicts people for keeping secrets, and then keeps secrets about who was convicted.

Re:That's rich

[martas]

step 3: claim nobody was ever convicted
step 4: 1984
step 5: profit!

Re:That's rich

[L4t3r4lu5]

If the names are stored in an encrypted database, we have them by the balls!

Oh, wait, this is the government. It's probably currently being mailed Second Class to a royal heir in Nigeria.

Re:That's rich

[ojintoad]

Yeah, I was thinking that when I read this line:

The government said today it does not know their fate.

and

GCHQ didn't immediately respond to a request for further information on the convictions. The Home Office said NTAC does not know the outcomes of the notices it approves.

Funny that the google search for "left hand doesn't kknow what the right hand is doing" returns a .co.uk site.

Re:That's rich

[pbhj]

Yeah those bastards, trying to stop children from being abused, people from being battered and the general populus from being blown up. What are they thinking.

I wonder in how many of the cases the guys at GCHQ could crack the encryption but weren't allowed to let on.

Re:That's rich

[Anonymous Coward]

Usually that's for the protection of the accused. I'm sure their families (the only ones who really need to know) have been informed.

Re:That's rich

[Richard W.M. Jones]

Yeah those bastards, trying to stop children from being abused, people from being battered and the general populus from being blown up. What are they thinking.

The problem is this law isn't very effective at this. Most children are abused by relatives and friends. Most adults are battered by the same. And the general populus has only the most remote risk of being "blown up" (less than, say, being hit by lightning, and far far less than the real risks - dying from heart attacks or cancer for example).

The unintended consequences of this law are serious and don't outweigh the risks. It's not just about people genuinely losing keys, but about having corrupt policemen pawing over data, or allowing people in positions of authority unquestioned access to details of your children and loved ones. Think there's no danger in that?

Rich.

Re:That's rich

[damburger]

Yes, because most people who beat their children keep vital evidence of their activities on encrypted hard drives. Fucking retard.

Re:That's rich

[Thanshin]

Oh, wait, this is the government. It's probably currently being mailed Second Class to a royal heir in Nigeria.

Don't worry, I know the guy; we're making some transactions I'm not at liberty to discuss.

Next time I speak with his majesty I'll ask him to send us the files.

Re:That's rich

[Dog-Cow]

I hope you are brutally murdered by a police officer who is "just doing his job".

Re:That's rich

[pbhj]

The article states that the act has only been used in 3 different types of cases. One of which is "child indecency" - presumably child pornography. Another "domestic extremism" which I read as a euphemism for "honour killings" or something along those lines and lastly terrorism which again I shorthanded as "blowing people up" rather than including the possibilites of use of biological agents, or taking out power supply or any myriad of other possibilities. These are still all things that I'm glad warrant investigation in the country I live in.

My wording could perhaps have been clearer but reading the article would have aided your comprehension.

From your other in-thread post: Why you think that terror activities committed by environmentalists shouldn't warrant police intervention I can't readily imagine, unless you're involved with such groups?

Re:That's rich

[pbhj]

And I hope you find means to combat your deep seated anger (seriously how many people a day do you wish death upon?) and find help to rehabilitate yourself back into civilised society.

Re:That's rich

[dissy]

If the names are stored in an encrypted database, we have them by the balls!

Oh, wait, this is the government. It's probably currently being mailed Second Class to a royal heir in Nigeria.

No wait, this is the UK government. It's probably being taken home by the secretary's brothers grandchild, with instructions to leave it on the train.

Not very surprising historically

[Anonymous Coward]

A hundred years ago today, if someone had a giant safe in their house, and they were suspected of any crime whatsoever, the legal authorities (of pretty much every country in the world, it would baffle me to hear about somewhere this would not be the case) would simply ask for the keys. If the person refused to hand them over, the person gets punished. The "punishment" can be of different forms - whether prison in itself, or just a lot more unfavourable treatment from a judge and the assumption of guilt going against you, but nothing at all? Never. The difference with encryption keys is not all that great.

Re:Not very surprising historically

[rastos1]

If the person refused to hand them over,

... they would search the house for the key and if not found they would get a locksmith to crack open it. No safe will stop a determined person with lots of time and right tools. The difference is that they can't crack your skull (yet) to find the keys and they can't break the encryption either.

Re:Not very surprising historically

[Anonymous Coward]

Two points.

It's not necessary to be suspected of a crime. Read section 49. It countenances industrial espionage, for example.

In your example, complaining loudly after the event, in the market square or in a newspaper, would not have been a criminal offence with a maximum sentence of 5 years in prison and a fine. See section 54 (same link).

Re:Not very surprising historically

[runlevelfour]

I think they are two different things. A safe is a physical object that holds, well physical objects. Not the same as encrypting data which is really just making information indecipherable. One hundred years ago today analogy would be closer to having a journal that the government wants to read but you wrote it in code.

Re:Not very surprising historically

[jimmypw]

I for one wouldnt block the authorities from accessing my encrypted data. Although it would be under my conditions for example they would be able to inspect it only with my presence and nothing would be printed or copied. After all thats the whole reason that data is encrypted in the first place. It is sensitive data uaually consisting of material that if comprimised could potentially destroy a career/life/personal security/identity/reputation.

Re:Not very surprising historically

[Anonymous Coward]

IAAL (UK) and no, it's not that simple. It never is.

If you want to look at the US legal situation for example, a good start would be to read United States v. Hubbell, 530 U.S. 27 (2000) then compare and contrast it to In re Boucher, (D.Vt. Nov 29, 2007) (NO. 2:06-MJ-91) (2007 WL 4246473) ("Boucher I") and In re Boucher, (D.Vt. Feb. 19, 2009) (No. 2:06-mj-91) (2009 WL 424718) ("Boucher II") (still under appeal). Read the full cases if you can find them, not a summary from some random website.

Case law is evolving and it's far from settled.

Re:Not very surprising historically

[MichaelSmith]

If the person refused to hand them over,

... they would search the house for the key and if not found they would get a locksmith to crack open it. No safe will stop a determined person with lots of time and right tools. The difference is that they can't crack your skull (yet) to find the keys...

I had my arm set after an accident two weeks ago. I reckon the stuff they gave me to inhale could easily be used to extract information like that.

Re:Not very surprising historically

[u38cg]

Sorry, you are wrong, at least in Western law. You are not and have never been under any obligation to assist law enforcement's investigation of you.

Re:Not very surprising historically

[Anonymous Coward]

The difference is that with a safe, it's possible for the authorities to open it via other means. (Lockpicking, safe-smith, brute force cutting)

With the encryption readily available to the public today, it's feasible to create encrypted data that cannot be recovered except by having the key.

Obviously, I don't agree with these convictions though, as has been brought up, what if I forget the password?

Re:Not very surprising historically

[Shakrai]

Sorry, you are wrong, at least in American law. You are not and have never been under any obligation to assist law enforcement's investigation of you.

Fixed that for you. The UK is usually regarded as 'Western' and it seems that evidently you do have to assist their investigation of you.

Re:Not very surprising historically

[Anonymous Coward]

How do you think this would be even possible? "Oh sure just enter your key, we'll just turn around. We won't peek. Promis! Oh and don't mind the hardware and/or software keylogger we installed."

Re:Not very surprising historically

[Anonymous Coward]

So the government's inability to do something warrents the deconstruction of basic rights of its citizens?

By that logic you should be forced to instantly admit anything because they cannot read your mind.

Re:Not very surprising historically

[Anonymous Coward]

A hundred years ago, if someone had a giant wall in their house, and they were suspected of any crime whatsoever, if the legal authorities demanded the key for the non existing hidden door in the wall they would not be thrown into jail failing to do so.

 

I routinely work with large files containing random data measuring performance of hard disks and different file systems. If I went to the UK with such a file on my hard disk the authorities could claim that the file is an encrypted container. I could not prove it is not and I would not be able to produce a key...

Re:Not very surprising historically

[Anonymous Coward]

But it's not a hundred years ago.... It's now, the world should have moved on.

Re:Not very surprising historically

[dissy]

A hundred years ago today, if someone had a giant safe in their house, and they were suspected of any crime whatsoever, the legal authorities (of pretty much every country in the world, it would baffle me to hear about somewhere this would not be the case) would simply ask for the keys.

With this law, there is no safe, and there is no key, and you still go to prison for 5 years if they claim something is a safe when it is in fact random data on a hard drive.

If police of a hundred years ago came into your house, and claimed that the houselplant by the door is a safe, and demands the key... That officer would get stabbed.
Even today that same officer would be put away for being mentally ill.

It is not the same then or now.

Re:Not very surprising historically

[xappax]

I guess the difference is that one lock is physical and one is really only a lock by metaphor - it's actually just a very difficult math problem. The only solution to the math problem (which will produce your data) is a bit of data, which the government expects you to tell them. Taking the idea that we can be compelled to open metaphorical locks further, the murder case (or whatever) itself could be considered a lock by metaphor, the "key" to which is your testimony or confession.

Of course, thinking about it in another way, a physical key is really just a manifestation of a bit of data as well - a set of specifications for the configuration of teeth on the key surface. What if you had destroyed all copies of the key to a certain lock, but still knew the specs for fabricating a new key - would the cops be able to compel you to turn over this metaphorical key?

Re:Not very surprising historically

[Anonymous Coward]

Actually you can easly blow a safe, how do you blow a well built encryption key for an encrypted partition?

Re:Not very surprising historically

[u38cg]

Apart from the law under discussion, no: the only difference is that in the UK your lack of co-operation can be brought up in court, which I don't really have a problem with. I suspect that once these cases get dragged through the appeals system, the law will be found incompatible with rights legislation.

Re:Not very surprising historically

[BradMajors]

There is a difference, any safe can be opened without the keys.

TrueCrypt

[Futurepower(R)]

No need to overwrite your data, which would show hard drive activity, and which would have no effect, since police always work on copies. TrueCrypt provides a hidden volume. The TrueCrypt hidden volume is not detectable.

"I would also like to know how the authorities could possibly tell a properly encrypted file from one that only contains random data and consequently how they could prove that a filesystem is, in fact, encrypted."

In every country, lawmakers with no technical knowledge whatsoever are writing extremely ignorant laws about technical issues. In fact, the UK law makes no sense.

Re:TrueCrypt

[vintagepc]

Not detectable? wouldn't there be a discrepency between the size of your other partitions and the total size stamped on the drive?

Re:TrueCrypt

[cpghost]

The TrueCrypt hidden volume is not detectable.

Only partially true. In a block dump of the HDD, the hidden volume appears as (not necessarily contiguous) blocks of data with perfect entropy. They may not know what's in them, but it's by no means invisible.

Re:TrueCrypt

[xenobyte]

The TrueCrypt hidden volume is not detectable.

Only partially true. In a block dump of the HDD, the hidden volume appears as (not necessarily contiguous) blocks of data with perfect entropy. They may not know what's in them, but it's by no means invisible.

No, the hidden volume cannot be distinguished from the other data inside the visible volume as it has got identical entropy and so on as the truly unused data. It is truly invisible and the presence of the hidden volume can only be inferred from changes in the supposedly 'unused' (unallocated) data, which requires snapshots taken some time apart.

One-way encryption

[indre1]

So if I encrypt my data with an encryption mechanism that can't be inverted by today's standards and someone doesn't like it, I'll go to jail?

Re:One-way encryption

[dotgain]

Store a megabyte of random data, and if somebody doesn't like it you go to jail.

Hell, what am I saying, this is the UK we're talking about. Paint your roof. Somebody doesn't like it? You're going to jail.

Re:One-way encryption

[Lexical_Scope]

"This file contains random-looking data and we suspect it to contain encrypted data with direct relevance to an ongoing National Security investigation. Please provide the decryption keys for the file '/dev/urandom' immediately or face 5 years in jail!"

Although, perhaps someone could write a tool that replaces /dev/random with some kind of encrypted device volume? Interesting...

Re:One-way encryption

[Archtech]

Actually, you've put your finger on something there. The key assumption behind most of the UK government's recent legislation is that, if someone disapproves of a given activity, it should be made illegal. (That way the government gets the votes of those who disapprove).

But there are very few things indeed that someone, somewhere, doesn't disapprove of. So increasingly, a quiet unimprisoned life in the UK depends on not drawing the attention of the authorities.

"Puritanism: The haunting fear that someone, somewhere, may be happy".
  - H. L. Mencken

Re:One-way encryption

[FutureDomain]

"Puritanism: The haunting fear that someone, somewhere, may be happy". - H. L. Mencken

I read that as "Putinism" at first...

Useless laws are useless...

[Anonymous Coward]

All this will mean is that people will stop hiding their data in "MyEncryptedDocuments" and instead hide it in plain sight. Will you check every single image on my system to detect flaws that might be hidden data? Will you parse every single document on my system to find hidden meta data (e.g. HTML attributes, Word under/redo histories, etc)? I'll just ROT13 it so you cannot look for English language.

Drug dealers use the same trick... Instead of hiding their drugs under floorboards or taped to the top of draws, they simply open a bag of flower, empty the contents, and refill it with drugs...

Re:Useless laws are useless...

[digitig]

Drug dealers use the same trick... Instead of hiding their drugs under floorboards or taped to the top of draws, they simply open a bag of flower, empty the contents, and refill it with drugs...

Well, that should confuse the sniffer dogs!

A thought experiment

[ebonum]

Suppose I have TrueCrypt installed on my machine, but I don't have anything encrypted. What stops to police from accusing me of having encrypted files and demanding a key? How do I prove random bits of data on my HD are random bits of data and not super secret encrypted files?
I doubt I even need Truecrypt installed for the police to use this to get a guaranteed 2 or 5 year conviction.

Re:A thought experiment

[maxwell demon]

You probably should always keep some encrypted porn on your computer. It's easily explained why you encrypted it (no one should find out that you have porn on your computer), and you can safely give the key to the police (as long as it's allowed porn of course, kiddy porn wouldn't work well :-)).

Re:A thought experiment

[GeorgeStone22]

2-5 years might be less than you'd get for disclosing the data.

Re:A thought experiment

[maxwell demon]

His assumption was that there is no data.

Re:A thought experiment

[ebonum]

To clarify, proving that a section of random bits of data on my hard drive is NOT an encrypted file is equivalent to proving that I am NOT a witch.

This could be easily abused by the police. All they have to do is find a section of random data on a hard drive. Then, the police ask you for a key. When you don't provide one ( because there is no key ), you get convicted on "Refusing To Decrypt Data" charges.

It isn't possible to say with certainty what is random data and what is encrypted data.

Re:A thought experiment

[Anonymous Coward]

Well, Truecrypt doesn't NEED to be installed. You can have it on a flashdisk/CD etc.

Also, it allows the creation of a fake directory with fake encrypted data which shows when the specific password for that (which differs from your "real" password) is entered.

Re:A thought experiment

[Anonymous Coward]

They'll assume you keep the kiddy porn in a hidden volume...

Re:A thought experiment

[Prof.Phreak]

...proving that I am NOT a witch. ...but are you heavier than a duck?

Re:A thought experiment

[Anonymous Coward]

truecrypt volumes are identifiable due to the way they are produced. this FAQ for HCHunt gives an overview: http://16systems.com/TCHunt/faq.php

Re:A thought experiment

[Mia'cova]

Well, when you have Truecrypt installed and your recent items point to x:\childporn0142.jpg, the same files they caught you distributing on P2P, and you've got a 2nd hard drive in your machine with only 'random bits,' not even a file system, they might just make the assumption.

Truly, there are many many ways of being caught with something. Most people don't realize how much history they leave behind. Even as the tools for hiding data get more advanced, the tools for creating/consuming information are also getting more complicated. When we see new security vulnerabilities in popular software/protocols so frequently, it's hard to imagine any of us have much of a chance when it comes to hiding + using some arbitrary data. There's always going to be some kind of data you screw up with and don't handle cleanly. A dubug log or SOMETHING will eventually trip you up. It doesn't even have to be on your machine if some remote log can tie an action to your machine. After all, hard to do something online without leaving residue in the tubes.. so do everything with tor too now? Is tor capable enough for arbitrary tasks? Probably not!

Yea... people will keep getting caught prosecuted for things like this. There will always be defendants who don't want to give up their keys. Imagine someone who recorded a video of themselves killing their significant other in a capital punishment state. That person isn't giving up their encryption keys.

I can imagine virtual machines living hidden in an anonymous tor cloud and such providing the 'next level' of encryption for more and more end-to-end encryption scenarios... there is so much more to come. Sooner or later though, law enforcement won't be able to keep up with everyone. I just don't see any easy-to-use 'solutions' that can actually beat law enforcement coming into existence anytime soon.

Re:A thought experiment

[mdm-adph]

Not only that, but you just made an excellent case for getting things like TrueCrypt outlawed entirely.

Re:A thought experiment

[Anonymous Coward]

Not even necessarily random bits of data. Steganography permits you to encode data into other, legitimate data. All it takes is for a policeman to say "What is the code which will allow me to get the secret data out of your holiday snaps?", and suddenly, you are non-compliant. In fact, the law is loose enough that basically, anyone who owns a computer can be imprisoned based on nothing but an accusation. It's scary.

Re:A thought experiment

[stdarg]

Well if you're doing this kind of thing you need to have an entire OS on the encrypted portion, via dual boot or virtual machine or whatever.

Over a decade ago I read about an encryption system called "chaffing and winnowing" that seems like it could be adapted to this plausible deniability requirement, but the overhead of the algorithm was pretty daunting.

Re:A thought experiment

[wvmarle]

You mean the UK even lost the "innocent until proven guilty" principle? That's really bad. I would expect the investigators should at least have proof (and in this case pretty strong proof) that there is an encrypted volume in the first place. The idea of first showing the judge that there is a door before being allowed to get the keys or otherwise opening it.

Re:A thought experiment

[Cheesetrap]

Well no, you could have your truecrypt install on a usb key, on a chain around the neck of that pink unicorn in your secret basement they also never found. (But it MIGHT be there!!)

Re:A thought experiment

[HeronBlademaster]

It occurs to me that even using the "privacy mode" in your browser isn't enough to hide your online activities from a determined law enforcer. All they have to do is get ahold of whatever log files the ISP keeps of your online activities - if the ISP is logging what IPs you connect to, you could be hosed.

Does anyone really know what data ISPs keep?

It's an appalling piece of legislation

[jimicus]

It's an appalling piece of legislation for a number of reasons:

1. It makes forgetting your decryption key/passphrase/whatever illegal. Yes, seriously. The burden of proof is on the accused to show that they can no longer decrypt the data - how the hell do you prove you don't have something?

2. The people who it was originally intended to inconvenience - the real terrorists, if you like - aren't going to be even remotely concerned by it. They know full well that there is a risk they'll be caught and spend time in jail. If it's a choice between "reveal the decryption key, thus providing the police with the only evidence they're likely to find which implicates you and a number of others for so many criminal activities you'll be in prison for 20 years and when you get out you'll get a bullet in the head for the people who you dropped in it" or "keep your mouth shut, go to prison for two years", I wonder which one they'll chose?

Re:It's an appalling piece of legislation

[velen]

You raise a valid point. It is easy for people with incriminating data to spend a couple of years in the rig instead of screwing themselves and their organizations over. The UK is bat-shit crazy.

Re:It's an appalling piece of legislation

[Anonymous Coward]

You forget the 2 years in the gaol would not likely be just 2 years like someone who does a crime such as breaking into a building. For someone of interest (even if its a financial interest that a domestic UK company wants to wrest from an offshore competitor), those two years can be of waterboarding, electrodes on genital areas, stress positions, starvation, sleep deprivation, or other means of torture.

We need more solutions like the Phonebook filesystem and TrueCrypt, not just on the volume level but on the file level, perhaps a way to store decoy stuff in a Word document, but the real data would be stored as an ADS, encrypted. Similar with storing a file on a Mac where the real data is in the resource fork.

Re:It's an appalling piece of legislation

[Anonymous Coward]

The original site seems to be gone, but a privacy group raised these issues when the bill was under consideration (story)

Re:It's an appalling piece of legislation

[xappax]

It's probably actually intended to give police the ability to coerce people who they don't have any actual evidence against, or who they may not even believe had anything to do with a crime. The process goes like this:
- Find a group who seems to share the ideology or ideals of some terrorist activity (for example, an animal rights advocacy organization).
- Put together enough flimsy misrepresented evidence to get a warrant
- Start a witch hunt. Target an activist and demand they decrypt all their data including communications, etc.
- If the activist won't cooperate, great, send them to jail and make a press release about how you successfully disrupted a terrorist operation.
- If they cooperate, sift all of their data - especially communications - for more flimsy misrepresented evidence and take the witch hunt to someone else.
- Repeat

This isn't just unfair to activists - it's a very, very poor way of trying to stop terrorism, because it basically consists of harassing random people with radical politics in the hopes that eventually they'll hit on a real lead to real terrorists. We should expect our security/intelligence organizations to be doing real investigative work, not just trawling the public and hoping they accidentally catch someone bad.

Re:It's an appalling piece of legislation

[zuperduperman]

> It makes forgetting your decryption key/passphrase/whatever illegal.

I'm totally talking out of my ass here, but giving the legal system *some* tiny shred of benefit of doubt, I imagine it is necessary to provide some kind of reasonable evidence that the person concerned *does* know the encryption key.

For example, a colleague or family member admitting (on witness stand, whatever) that they have seen you enter the key to access the data regularly or in recent times, combined with corrobarating evidence from the computer (file access, modification timestamps, etc).

Or perhaps, some unencrypted data on the hard drive that indicates you know the key (eg: an email or slashdot posting stating that you've encrypted your drive and memorized the key).

Now: even taking this into account the law is stupid and dangerous and open to abuse. But I hope it is not so bad as to allow random conviction of anybody in the vicinity of an encrypted file.

Re:It's an appalling piece of legislation

[jimicus]

You raise a very good point. So good, in fact, that I thought I'd take a look at the law myself. Bear in mind IANAL so take everything in this post with a pinch of salt.

The relevant section of the law is here:

http://www.opsi.gov.uk/acts/acts2000/ukpga_20000023_en_8#pt3-pb1

I refer you specifically to section 49(2), which governs when a notice under this act may be given:

2. If any person with the appropriate permission under Schedule 2 believes, on reasonable groundsâ"

(a) that a key to the protected information is in the possession of any person,

Further down, we get an idea of what sort of defences are open to someone who receives such a notice - section 53(3):

(3) For the purposes of this section a person shall be taken to have shown that he was not in possession of a key to protected information at a particular time ifâ"

(a) sufficient evidence of that fact is adduced to raise an issue with respect to it; and

(b) the contrary is not proved beyond a reasonable doubt.

I note clause 3a is nicely open to interpretation.

Remember this is the UK

[Jane Q. Public]

In the U.S., people generally cannot be required to provide encryption keys under the 5th Amendment. However, there are exceptions. There was the recent case of one man who was searched by Customs (or DHS, or whoever) at an airport. One of the agents discovered child pornography in an encrypted portion of the disk that had been (temporarily) opened for access.

Somehow, by the time authorities took possession of the computer, the encrypted drive was no longer opened. The last court decision about that case I am aware of states that a subpoena for the encryption key can be enforced, because the government was already aware of the existence of illegal material, and where it was. All they needed was a "key". This is vastly different from demanding a key first, so they can poke around in your private material.

As an analogy, imagine a shed in your yard that you keep locked. Law enforcement would, under almost all circumstances, require probable cause or a warrant based on probable cause in order to go onto your property and search that shed. However, if they already knew, with little doubt, that there was illegal material in that very shed, then they have the legal justification for a warrant, or a subpoena of whatever information is necessary to open the shed.

Re:Remember this is the UK

[Yogiz]

As an analogy, imagine a shed in your yard that you keep locked. Law enforcement would, under almost all circumstances, require probable cause or a warrant based on probable cause in order to go onto your property and search that shed. However, if they already knew, with little doubt, that there was illegal material in that very shed, then they have the legal justification for a warrant, or a subpoena of whatever information is necessary to open the shed.

It's a funny law in this case, as you can be arrested and convicted for not letting the police into that shed in your back yard even if you have no shed in your back yard. Everyone with a back yard (hard drive) could be convicted to jail without any proof. Convenient.

I'm afraid to travel to the U.K. even with my laptop's harddrive overwritten with /dev/urandom because if they say it's an encrypted drive, how will I prove it's not?

Re:Remember this is the UK

[Takichi]

What I don't understand is why people can't say that they forgot the key? It would seem very difficult to prove that they in fact knew and weren't sharing the information.
What happens if the person says they've lost the key to their shed? I'm guessing that the police would break the door down. Would they also have the option to leave the shed intact and prosecute the owner for forgetting where the key is?

Re:Remember this is the UK

[bradley13]

As I recall, another aspect of customs searches is this: if you have not yet cleared customs into the USA, you are not yet considered to be on US territory. As with Guantanamo, the government declares that actions outside of US territory do not have to respect US law.

Re:Remember this is the UK

[Mhtsos]

If they already knew the material was illegal with enough certainty they should have used that in court and never needed the encryption key. In the shed analogy, is there a separate offense to not give the key to the police, after they supply you with a warrant, in case they can't physically enter it? And I wonder what happens if you really don't HAVE the key any more, and in the analogy if someone actually forgets or on purpose destroys the encryption keys.

Re:Remember this is the UK

[Anonymous Coward]

"Let us in the shed!"
"What shed?"
"The secret underground shed you got 'ere."
"What?"
"We say you got one, now either open it or prove there isn't one."

Re:Remember this is the UK

[wodon]

Using your shed analogy. It would be more like them seeing a dead body in the shed then you locking the door.
They had seen a dead body before it was locked and therefore have cause to go in (in fact they wouldn't need a warrant).

This has all come about because the ability of law enforcement to brute force passwords/keys has become impractical.

Phycial security could always be bypassed, even if that meant using oxyacetylene torch to cut the front off a safe. A computer encrypted with a 2000 bit key is not the same.

Re:Remember this is the UK

[DigMarx]

"No, no. Look. This shed business -- it doesn't really matter. The sheds aren't important. A few friends call me Two Sheds and that's all there is to it."

"You're fucking nicked, me old beauty."

It is a UK issue, after all.

Re:Remember this is the UK

[JasterBobaMereel]

This is the exactly the equivalent of a search with a warrant

They need to have the Section 49 request approved, then they need to apply to a Judge to enforce it, and then if the person refuses they need to prosecute in the normal way

i.e. they need a valid reason to issue a section 49 request, and they need to be able to justify it in court if the person refuses

They had 15 requests, 11 refused, only two were convicted ... not a very good hit rate

Re:Remember this is the UK

[Yogiz]

If it's underground you can just dig around and show it's not there. An invisible untouchable shed on the other hand...

Re:Remember this is the UK

[misexistentialist]

There is still a difference between forcing a shed door--damage to the door is less important than solving a probable crime, and if nothing's found not much harm was done--and forcing a person's brain--torturing/jailing someone to make them talk isn't worth the price. If the cops already "know with little doubt" that you have done something illegal, then additional evidence is unnecessary for a conviction anyway.

Now if a customs officer sees Truecrypt installed, he can lie that a partition was mounted with child-porn and force you to decrypt it.

Re:Remember this is the UK

[Jane Q. Public]

In the example I gave, the encrypted disk or file had been "opened" when the customs guys saw it. So there was prima facie evidence that the owner knew the password.

Re:Remember this is the UK

[Jane Q. Public]

Well, two thins about that:

(1) When was the last time you can recall that you could reliably trust the U.S. government to obey its own laws?

and

(2) I am not certain it was Customs. It might have been TSA or DHS.

Re:Remember this is the UK

[Jane Q. Public]

No, that's like saying you know where the warehouse full of heroin is, but you haven't bothered to go get it.

Law enforcement can testify that they have solid evidence that something exists, but the courts want the actual proof. So the probable cause gets the court to issue a warrant or a subpoena, which gives law enforcement authorization to intrude as necessary (with some exceptions) to get that actual proof. The important point being that it requires probable cause first.

Since the court has issued the warrant or subpoena, yes it has the power to punish you if you do not then supply it. Contempt of court or other such measures may be applied.

As for your last point, the disk or file had been unencrypted when law enforcement saw it, so there is no reasonable argument that the owner does not know the password.

Re:Remember this is the UK

[Jane Q. Public]

That is what I wrote: "... if they already knew, with little doubt, that there was illegal material in that very shed..."

Re:Remember this is the UK

[Jane Q. Public]

It was just an analogy. But you are correct: forcing one to divulge specific knowledge that can incriminate you is specially prohibited, at least in the U.S. But again, you cannot ignore the fact that they already had strong evidence (eyewitness) that a crime had been committed, and that they knew where the proof was to be found.

As for the "knowing with little doubt", what we are really talking about here is more than just probable cause, but at the same time law enforcement had nothing concrete to present as evidence. The court wants real evidence. And on that basis the court (properly and legally) can subpoena that evidence.

And lastly, the agent described the pornography he found in graphic detail. He could not simply lie about it, because that would be found out and he would face professional sanctions and probably criminal and/or civil charges as well.

Re:Remember this is the UK

[Buzer]

if you have not yet cleared customs into the USA, you are not yet considered to be on US territory. ... the government declares that actions outside of US territory do not have to respect US law.

So if you hijack a plane when within US airspace, but you haven't landed yet (and thus haven't cleared the customs) and use it to destroy some building and kill X number of people, you did nothing illegal in the US? And if you manage to escape, you are merely arrested for illegal entry?

Re:Remember this is the UK

[Anonymous Coward]

Overwrite your laptop harddrive with zeros...

How about if a Policeman...

[viraltus]

has a warrant and asks you to open the trunk of you car? Do you feel police is forcing you do to self-incrimination? I don't think they're forcing you to say you are guilty of anything, they want to check your property to see if you actually are guilty of anything.

Re:How about if a Policeman...

[kaladorn]

I'm unaware of any case where you can be given 5 years for not opening the trunk of your car. You could probably be charged with something, but it wouldn't be five years in jail.

Re:How about if a Policeman...

[ZekeSpeak]

has a warrant and asks you to open the trunk of you car? Do you feel police is forcing you do to self-incrimination? I don't think they're forcing you to say you are guilty of anything, they want to check your property to see if you actually are guilty of anything.

If a policeman has a warrant to open the boot of my car then I will assume that if I don't comply then the policeman will break it open and damage my car in the process. There's no point to resistance in this situation but in the case of an encrypted file they won't be able to break in without your assistance. It's a matter of practicality, not legality.

Re:How about if a Policeman...

[arbiter1]

Opening a trunk and encrypted data are 2 different things, as for US's 5th amendment. If said data is stored in like safes or such with a physical key you have to give it up (they could get in to the truck easy anyway), if the information is stored in your head its protected via the 5th, but with that being said its been debated lately if say data encrypted with military encryption and the only key is stored in your head is protected by the 5th. since giving the key will consistute giving up 5th. When data is encrypted with say 256bit SSL, it would take a super computer many years to break the decyption key and by then you could ask for speedy trial and they couldn't have their key evidence.
As for laws in UK i am not sure, but for US its been in debate cause a guy that crossed in the US from canada had encrypted data and they tried to make him give the key up.

Re:How about if a Policeman...

[TaoPhoenix]

We might have to move towards "Triple-Blind" keys or such. Bruce Schneier had an article of the sort. "I don't know the key officer. I never did. It's remote-encrypted/etc".

Maybe you could store the key in a Schrodinger's Cat Lock.

"Not only do I not know the key, but I can only retrieve it if I have not been served a police demand. I am monitored by a live web-recorder with quad redundancy. If you serve me notice, the key will expire permanently."

Re:How about if a Policeman...

[stupid_is]

How about just make some software that encrypts two parts of your drive "/legal" and "/illegal". Then have two keys - one key opens both, the other key opens "/legal" and then zeros/randomises "/illegal" irretrievably. Should be moderately straightforward to implement (although possibly discoverable if the police ever disassemble the .exe)

But I didn't say that really....

Re:How about if a Policeman...

[grahamm]

When I open the boot (trunk for those in the USA) of the car and the policeman finds a handwritten journal which is in code, does the warrant allow him (or can he get a warrant) to force me to decode the contents of the journal? Forcing you to decode the contents of the journal could (depending on the actual plaintext) be self-incrimination. To my mind, the only difference between paper documents written in code and encrypted files on a computer is the medium on which the documents are stored.

Re:How about if a Policeman...

[stupid_is]

bah - this idea is further down. Ho hum, I'll continue the tradition of not reading everything in full before posting.....

Re:How about if a Policeman...

[Shakrai]

How about just make some software that encrypts two parts of your drive "/legal" and "/illegal". Then have two keys - one key opens both, the other key opens "/legal" and then zeros/randomises "/illegal" irretrievably.

You do realize that if the police are actually looking at you for a crime they are first going to make an image of your hard drive before they attempt to do any forensics/decryption/etc on it, right?

Re:How about if a Policeman...

[DiamondMX]

That would have to be a hardware hack, the (moderately competent) police do not access your harddrive through your OS or while it's in your machine. And data changing itself even through a hardware mechanism would be clear tampering with evidence.

The time has come...

[distantbody]

To NUKE the place from orbit!!!

Re:The time has come...

[Anonymous Coward]

To NUKE the place from orbit!!!

Terrorist!

We have laws for people like you, the moment you forget your encryption keys it is you who will be nuked from orbit!

Re:The time has come...

[fluch]

Insightful? Who moded the above "insightful"?! It should be moded "redundant"!

Re:The time has come...

[Anonymous Coward]

yay, genocide
fuck you and fuck all of you ignorant americans who have no idea how UK law works. i am so tired of your 1984 memes that you smugly repeat to yourselves. you had a war criminal in power for 8 years and yet with all your rights and controls on government (GUNS GUNS GUNS I LOVE GUNS MM PROTECT ME FROM THE DARK FOLK) he wasnt removed. funny that, isn't it.
this law will be struck down by the law lords or some other judge. not because it's an affront to ARE LIBERTY but because it's poorly thought out. the government is idiotic and our independent judiciary will (rightly) fuck the government over on these silly, reactionary laws.
i prefer the situation in the uk where a silly law like this can be struck down by a judge (which happens often) instead of a situation in the US where the patriot act or FISA are ignored and tolerated once they're passed.

The solution

[Thanshin]

The solution to this and other similar "bad law" problems is making them big and visible to the common population.

1 - Get a worm that allows to save data on infected computers.
2 - Get an encrypting program that supports plausible deniability.
3 - Infect self with worm.
4 - Install encrypting program in all infected machines.
5 - Accuse random people of having criminal data in their computers. (e.g.: "I was playing a WoW game and this guy told me he had several thousand [criminal data]").

Re:The solution

[Anonymous Coward]

The common population is too stupid and lazy to understand or care about the problem until the ruling class and the media which feed at their trough devote time and airplay telling them that it's important.

No, the real solution is to drop the people that created the problem right in their own mess. These happen to be the same people who could correct the problem. I am of course talking about politicians.

Say, hypothetically, you're a computer tech and you happen to be servicing some MPs computer one day. It'd be an awful shame if you, the unwitting computer tech, were to accidentally stumble upon some very naughty images. Of course, it would be your duty as a citizen to report such criminal activity... only, you've found that after shutting down the computer, you no longer have access to the naughty content. Instead, you identify this large file, several gigabytes in size - which appears to be random junk - but you, as a computer tech, know that it's an EVIL ENCRYPTED PARTITION. The naughty pictures must be in there!

Now that law enforcement have their witch hunt radars powered up, the publicity over this incident will be high. The politician will very quickly learn that he, in fact, can not disprove the claims of the computer tech. Furthermore, he cannot prove that the several gigabyte junk file on his computer isn't an encrypted partition whose keys he is refusing to hand over. Finally, he will come to realise that he will be going to prison because of these reasons.

Just watch how fast the wheels of justice spin when one of the ruling class gets caught in the machine.

Of course, if he's unliked, he'll be thrown under the bus, but at least there'd be a lot of publicity for it. Other politicians will see that the same thing could happen to them, and be more likely to reconsider their stance.

And hey, if he does go to jail, I wouldn't feel too bad. He's probably fucked over hundreds of thousands of people during his career. No such thing as an innocent politician, after all.

Re:The solution

[Thanshin]

Now that law enforcement have their witch hunt radars powered up, the publicity over this incident will be high. The politician will very quickly learn that he, in fact, can not disprove the claims of the computer tech. Furthermore, he cannot prove that the several gigabyte junk file on his computer isn't an encrypted partition whose keys he is refusing to hand over. Finally, he will come to realise that he will be going to prison because of these reasons.

Furthermore, I'm sure in UK there are multiple tv programs entirely dedicated to gossip and very willing to pay a large amount for your declarations, as a concerned citizen, describing in excruciating detail the image of a poor little girl you found in the politician's computer.

You could even help the police artist to make a picture of the poor little abused girl.

If after a couple months, working twice a week to the tv program while you make some declarations on other channels, they've still not found the girl, it's your obligation as a concerned citizen to suddenly remember there were also some maps you paid no attention to (understandable, giving the circumstances) and that probably mark the location of the corpse.

Mercifully, some crazy guy shoots down the politician soon after, so you may return to your normal IT job. But you can't forget the terrible images, and you end up joining the computer investigation police force.

And, as you walk towards the sunset, you're thinking who else might have a large, unaccounted for, garbage file.

And a slow country song starts in the backround.

Re:The solution

[houghi]

A bit how we try to attack the RIAA by letting them sue random people?

Re:The solution

[Anonymous Coward]

Actually this is a great idea for everyone, except for the person doing it. :)

They already shut innocents

[Anonymous Coward]

Well the Britons already shut innocents in the head for running, forget your password and be send to jail is not too heavy.

Re:They already shut innocents

[Anonymous Coward]

How, exactly, do you shut somebody in the head? Is there a door up there?

Re:They already shut innocents

[Anonymous Coward]

to be fair though, he did look foreign....

Re:They already shut innocents

[Hatta]

This is not flamebait, even if it contains spelling errors. It's always worth pointing out that the UK is an all around police state these days.

on ostracism

[Anonymous Coward]

Let us put the blame where blame is really due: on the civil servants who were only following orders (TM) when they used their technical skill to establish that a computer had encrypted data on it, knowing full well that their work might be used to convict someone merely for refusing to speak when an attempt was made to force them. I am sure that some of you guys are even reading this post, angrily justifying in your head why you do your job -- for the children, against the terrorists, because it's an "intellectual challenge", to put food on the table -- but none of these justifications require you to do what you do. It is quite simple: you get a kick from that little drip of power granted to you by an abusive state when you get to contribute all your little bit toward denying the freedom of some poor sod. You trod on ants which were not in your way as a kid, it excited you but you told yourself they were pests anyway; your Day-to-day activity and contribution to society has not improved since then.

  We must single you out and peacefully turn our backs on you for the traitors to freedom that you are. Don't try to justify what you are doing, don't retort with the 1% of cases that the application of your skill was justified to protect the country, because we both know why you are employed to do what you do. Resign, apologise, and join the rest of us!

The UK can suffer serious blowback for this

[Anonymous Coward]

Yes, the Brits might be able to find something by untrained criminals by this hard handed method, but the blowback from this strategy is going to seriously hurt them in the long run.

Trading partners will be leery to send envoys over to make agreements when at a whim, their machines can be searched, and any trade secrets copied off. If deals are done with British companies, they will be done out of the country, or via electronic means. Companies will not want to set up branch offices in the UK because their facilities can be searched at any time and trade secrets taken. Finally, where does this end? Does someone in the UK have to give up all root/Administrator/sa passwords on request that are on the remote company's VPN or else go to prison?

Of course, the true terrorists are not going to be caught. They don't bring laptops in with their super secret plans. It seems the UK is aiming the RIPA act for more of an industrial espionage type of game than anything else, intending to demand trade secrets via the heavy hand of their bobbies, then hand the results over to their domestic interests. Other countries do this too, but those are very repressive regimes, not a First World nation.

Of course, legitimate people will get around this, but it requires backflips and makes PHBs less interested in doing business with the UK. Some means that people will use:

1: TrueCrypt is the first thing. Perhaps even a TC hidden OS with the decoy OS storing some random chaff in the outer volume. This way, there are no MRU traces of anything in there.

2: BitLocker and multiple users. The laptop's owner has a non administrator user and given the password of the account with the business critical data once in the UK before the meeting. Then when it comes time to head back to the States, the user account is disabled via remote. Of course, a hardware device to grab the Bitlocker volume key can get around this. The user account with the data can be protected via EFS, so when it expires, not even an Administrator can access it. Of course, there are varying methods to recover EFS protected files, so perhaps an Administrator-only accessible script that runs that would erase the sensitive user account before hitting the airport might be needed. If the user is questioned, he could show that he had no access and likely no knowledge of that functionality, it was corporate HQ who did that.

3: VMWare ACE installations. Similar to #2 above, the laptop will have an ACE install with a complete Windows VM present that has all the information needed to access a company network. The ACE install will be valid from a certain starting time and expires before the overseas traveler boards the plane home. Also, the company will E-mail the user the password to the ACE VM once he or she checks in. This way, a traveler will pass through security, and if questioned about the ACE install, will be unable to provide any information on it. On the way back, if the laptop is seized, the ACE VM would be expired and not accessible even with the right credentials. (Of course, the ACE VM would have some security inside it so just using it wouldn't mean free reign on the home corporate VPN.)

4: The hard disk for the business stuff would be mailed to the envoy's hotel. Traveler has a decoy OS on the laptop that is being used for travel, has a hard disk with the real data sent via post (and the password to the data sent via another method). Then the user puts in the real HDD, does his/her work, and when it comes time to head home, the real HDD is either sent back via mail, erased, or physically destroyed. (2.5" laptop drives are delicate and a couple hits from a ball peen hammer have a good chance of shattering the platters.

5: Then, there is the old fashioned way of having the laptop just be a remote client with no data stored locally. The user would have network access that would start when he or she got to the hotel and called in with a coded "OK" message, and expire before he or she goes to the airport.

Re:The UK can suffer serious blowback for this

[IamTheRealMike]

You mean like how Echelon caused people to stop doing business with US companies? Right ...

Re:The UK can suffer serious blowback for this

[Anonymous Coward]

How about a buddy system? You have half a password and a buddy in some other country has the other half. Neither of you know the other's part. When you want to decrypt you type in your half, contact your buddy and they remote in and type in their half. You get arrested feel free to tell the police your half, but if they want your buddies half they will need to get a extradition order or a very co-operative law enforcement in the buddies country. Just a thought.

Re:The UK can suffer serious blowback for this

[t0rkm3]

To do so would have meant no business with or through USA, Canada, UK, Australia, or New Zealand.

That's a lot of money.

The logic is obvious

[Kupfernigk]

If you are part of a terrorist cell (or a criminal gang) and the police obtain your encryption keys, telling the rest of your cell or gang will enable them to destroy their own compromised data before PC Plod arrives. That is the logic behind the law.

The alternative is to lock up everybody who has supplied keys until any legal case is over, so they cannot communicate the news. This would be worse.

Law is simply unable to keep up with the development of mass communications and freely distributable digital data. It's a simple as that. The options are to do a 16th century Japan and ban progress, or accept there will be problems en route.

Re:The logic is obvious

[damburger]

Where the definition of 'terrorist cell' is up to the authorities, and in this case means 'animal rights activist'. It could mean anything according to this corrupt, overbearing government.

Re:The logic is obvious

[rtb61]

The is so wrong. The logic of the law is that you are now legally liable for your memory. Can't remember something 5 years in prison, it is by far the most offensive legislation there is, hmm, what next death penalty for amnesiacs.

I have forgotten lots of passwords, I have had to rebuild data, redo secure OS installs, drop web accounts, have passwords reset and what some fucked up government and corrupt court decide that they want that information, my total by now 5 years at a time would be up around 250 years in jail. The law is bullshit, there is a profound difference between telling a lie and withholding the truth, conscious effort is required to tell the lie but withholding the truth simply requires a lapse of memory. How many people, failed to get every answer right in every test and exam they have taken, billions of people, it is the norm and in by far the majority of instances, they had been provided all the information required to get 100 percent on those tests and exams.

Now lets start holding politicians to the same standard, zero forgetfulness, zero lapses of memory, zero forgotten promises, 5 years jail for every offences, oh yeah, because it does affect national security.

Re:The logic is obvious

[Thanshin]

Now lets start holding politicians to the same standard, zero forgetfulness, zero lapses of memory, zero forgotten promises, 5 years jail for every offences, oh yeah, because it does affect national security.

*Ten years later, in the presidential speech*

"People or our most beloved country. You say I promised to end the war. Well, I remember having made that promise. I want to be sure you've understood this point. I do remember. Do you hear me? I remember.

I simply don't give a flying fart about you now that I've got the votes.

And I might add: HA HA... You gullible losers..." ...

Well, it's not a big improvement over the current situation, but it's something.

Re:The logic is obvious

[digitig]

Where the definition of 'terrorist cell' is up to the authorities, and in this case means 'animal rights activist'. It could mean anything according to this corrupt, overbearing government.

Some animal rights activists do use terror tactics, including bombing campaigns, so in this case it might not just mean 'animal rights activist', it could mean everything you normally mean by 'terrorist'. Yes, there are huge problems with the law, but its being used against animal rights campaigners is not de facto one of them.

Re:The logic is obvious

[Kentaree]

Now lets start holding politicians to the same standard, zero forgetfulness, zero lapses of memory, zero forgotten promises, 5 years jail for every offences, oh yeah, because it does affect national security.

You could get elected if you went into politics with that agenda, before not implementing it with no consequences! :p

Re:The logic is obvious

[Anonymous Coward]

Well then, I guess a pretty fine and dandy way would be using a specific (self-coded?) application to unencrypt your files, one the police needs to use if they want to decrypt them, and having a security option that, if you haven't done a certain thing (say, activating a specific bit on a specific offset on the file), would make the file self-destruct by insertion of random data, and if the file was write-protected, it simply wouldn't decrypt, and you would inform them of this.

Or you could use TrueCrypt with the whole two-password thing, for plausible deniability, but there may be ways to find out there's something hidden, I'm not sure on that field.

But these are just circumventions to laws that seem rational and sensible to the "general public", but are actually draconic laws straight out of the beginnings of some totalitarian dictatorship.

Re:The logic is obvious

[TaoPhoenix]

Zero Wing is the key to the Encrypted Presidency!

Re:The logic is obvious

[Thanshin]

Zero Wing is the key to the Encrypted Presidency!

Interestingly enough, someone who didn't follow the entire conversation might not reach that, most obvious, conclusion.

We do stand in the shoulders of giants.

Just, very small and very crazy ones, who wander around babbling something about tin foil.

Re:The logic is obvious

[Anonymous Coward]

Not only that. They can claim that any bunch of random data on your disk is actually hiding something encrypted and ask you for a password that never exists in the first place. This is basically a license to put in jail anybody with absolutely no reason.

Re:The logic is obvious

[damburger]

And is there any indication that these people were dangerous bomb-wielding psychos, based on what the government is saying? No.

Re:The logic is obvious

[Vindicator9000]

Didn't the UK define terrorist to mean 'American radio presenter that we don't like?'

Re:The logic is obvious

[DJRumpy]

That doesn't make it a good law. There comes a point where the end does not justify the means.

My favorite quote from Benjamin Franklin is still one of my favorites, and still very relevant even today:

Any society that would give up a little liberty to gain a little security will deserve neither and lose both.

Re:The logic is obvious

[jabuzz]

Actually the UK has a problem with extremist animal rights activists who do go round bombing things. Some of these are now behind bars and rightly so.

Re:The logic is obvious

[Anonymous Coward]

Where the definition of 'terrorist cell' is up to the authorities, and in this case means 'animal rights activist'.

You have evidence for that, or are you just making stuff up?

Re:The logic is obvious

[oji-sama]

Good. But hopefully because of something more subtantial than not providing decryption keys.

Re:The logic is obvious

[Feef Lovecraft]

Michael Savage was recently mentioned by the UK papers as appearing on a list of "undersirables" people that would actively be denied entry to the UK based on the grounds he is; "Considered to be engaging in unacceptable behaviour by seeking to provoke others to serious criminal acts and fostering hatred which might lead to inter-community violence." The Guardian had a full list here

Re:The logic is obvious

[IamTheRealMike]

Erm, from TFA:

The Register has established that the woman served with the first section 49 notice, as part of an animal rights extremism investigation, was not one of those convicted for failing to comply. She was later convicted and jailed on blackmail charges.

There is actually a series problem with animal rights extremists in the UK. Some of them are terrorists in every sense of the word.

Re:The logic is obvious

[dbet]

Sorry to be the one who points this out, but it is a certainty that they're going to get more corrupt, unless you murder them.

Re:The logic is obvious

[Anonymous Coward]

No we defined 'undesirable person' as 'right wing, bigoted radio presenter'.

I don't agree with the decision (totally ignores civil liberties) - but just wish to point out that its nothing to do with him being a yank or a radio presenter or a terrorist - its the vile bullshit he was spewing that the authorities objected to. If we going to ban muslim extremists for speaking their minds, we really should apply that to all extremists speaking their minds.

Re:The logic is obvious

[fracai]

There is actually a series problem with animal rights extremists in the UK.

Perhaps they should be tried in parallel? It would certainly speed up the process.

Re:The logic is obvious

[schon]

If you are part of a terrorist cell (or a criminal gang) and the police obtain your encryption keys, telling the rest of your cell or gang will enable them to destroy their own compromised data before PC Plod arrives. That is the logic behind the law.

Umm, that's not logic. That's anti-logic.

Logic would be the realization that a terrorist or organized criminal break laws by definition. Did the people who wrote this honestly think that a terrorist would say "oh, no - our plot to murder thousands of innocent people has been discovered - I'd tell my co-conspirators, but there's that pesky law preventing me!"?!?!

Re:The logic is obvious

[binaryseraph]

If it was animal rights activits, they should have just eaten hamburgers infront of them. That will get the password out quick... Then again, that might also count as torture. "burger-boarding"

Re:The logic is obvious

[Anonymous Coward]

My wife's boss had death threats and faeces shoved in his mailbox by these terrorists because his company does IT work for the London office of a large Japanese conglomerate with a partly owned subsidiary that was once a supplier (not of animals) to Huntingdon Life Sciences. They use exactly the same twisted mentality as Al Qaeda to justify their attacks on the most vaguely related of targets.

Re:The logic is obvious

[rant64]

They can claim that any bunch of random data on your disk is actually hiding something encrypted

This may be technically true, and the poor, random, but arrested sod may get away with the usual blank stares. Anyone using TC, Vsoft, or any of the full disk encryption software on the other hand, will have a hard time convincing me or anybody that the random stuff on your drive is not actually data if the boot loader pops up.
As for me, the wall in my study room also happens to be, ehm, decorated with some certificates for IT courses, photos and old entrance tickets from LAN parties etc. and I have books about technical/programming stuff lying around. How are you EVER going to convince anybody that you don't know how that 'random data' ended up on your hard drive?

Unless full disk encryption is enabled by default in future operating systems, blank stares or denying the obvious are not going to get us out of trouble.

Re:The logic is obvious

[MBGMorden]

Absolutely true. I'll admit that this isn't even my original Slashdot user ID. The original one I forgot the password to and it's email is set to a long dead account, so I'm certainly not getting any hints or resets via email.

I've forgotten tons of others too. Just because someone can't give you the password to an encrypted container or file doesn't mean they're withholding it. Heck I've setup plenty of Truecrypt volumes for sending data back and forth to vendors at work. Lord knows I've forgotten most of those passwords after the projects they were associated with were completed.

Re:The logic is obvious

[mdwh2]

Indeed - it's also unclear on what grounds you can prove that a bunch of random data isn't in fact encrypted data in the first place.

Re:The logic is obvious

[InsertCleverUsername]

I think you've nailed it. The obvious answer to charges like this is to use the Reagan defense (famously employed in the Iran Contra scandal). Claiming to not remember is altogether different than lying (and there are rooms full of experts that can attest to the fragility and malleability of human memory). I'm not saying it's morally defensible, but if Clinton could have believably used this ploy in Lewinskygate, the country might be better off today.

Re:The logic is obvious

[Anonymous Coward]

And maybe it's just a file with random data and there is no key? I do hardware RNG testing and keep dozens of gigabyte RNG output dumps around. Will I be liable for those "passwords"?

Re:The logic is obvious

[digitig]

No. Nor is there any evidence that they weren't, because the government is keeping everything secret. That is a problem, I agree. But you seemed to be suggesting they were animal rights activists rather than terrorists, and that this was a case of terrorist legislation being used on non-terrorists, which happens, but not necessarily in this case. The union of the sets "Animal rights activist" and "Terrorist" is not empty.

Re:The logic is obvious

[westlake]

The law is bullshit, there is a profound difference between telling a lie and withholding the truth, conscious effort is required to tell the lie but withholding the truth simply requires a lapse of memory

There is nothing quite like a 6x8 foot cinder block cell and a bunk mate named Big Mike to bring old memories into focus,

Re:The logic is obvious

[xaxa]

"Seven animal rights activists who tried to close down Huntingdon Life Sciences by blackmailing companies linked to the animal testing laboratory were jailed today for between four and 11 years. ... a six-year campaign involving hoax bombs and falsified allegations of child abuse"
"The activists plotted their campaign from their headquarters, a country cottage near Hook, in Hampshire. From the building -- which police had bugged -- they used encrypted emails, spreadsheets and coded messages to organise the blackmail of the companies and individuals."
"While rarely causing physical harm, these offenders thrived on the fear they created through threats and intimidation."

http://www.guardian.co.uk/business/2009/jan/21/huntingdon-animal-rights

Re:The logic is obvious

[Shakrai]

its the vile bullshit he was spewing that the authorities objected to

If the authorities get to decide that what you are saying is "vile bullshit" and punish you for saying it then free speech is worthless and we might as well abandon it.

Re:The logic is obvious

[instagib]

I don't think the authorities involved are that stupid. You can be sure they deduced from the suspect that they do remember the keys, and that they hide significant information relevant to the prosecution. It's not 1984 everytime someone has to give up information to the police.

Re:The logic is obvious

[Dishevel]

Actually it's...They who can give up essential liberty to obtain a little temporary safety, deserve neither liberty nor safety.

Re:The logic is obvious

[EatHam]

and in this case means 'animal rights activist'

Yes, well, it's all about the animals isn't it? I mean, really, if I were to bomb things, burn things down, physically intimidate and threaten people, indoctrinate other people into a cult-like society of violence and terror, but it was for the animals, certainly I could not be called a terrorist, could I?

Re:The logic is obvious

[DJRumpy]

You'll find about 10 variations of the quote on the web, and all of them considered relatively accurate ;)

If they had only used DAT tapes..

Re:The logic is obvious

[phoenix321]

Replacing "keys" with "incriminating documents":

"If you a part of a criminal gang and the police obtains incriminating documents, telling the rest of your gang will enable them to destroy their own compromised data before the cops arrive. That is the logic behind this law."

And then:

"The alternative is to lock up everybody where incriminating documents have been found until the case is over, so they cannot communicate the news. That is the logic behind this idea, which would mean no calls to a lawyer therefore being declared unconstitutional for decades."

One suspected criminal is arrested and the police has to catch all other pieces of evidence before the rest of the gang destroys them. Nobody would declare that law is unable to keep up with that and nobody would ever dare to abolish due process, in dubio pro reo and all that which make the primary and most important differences between Law Enforcement under the Rule of Law and the Mafia themselves.

Simply because documents are electronic and not paper should not change one iota of due process. Criminals have been able to destroy evidence since the dawn of mankind and definetly since the dawn of Western democracies, when we decided to rather let some of the guilty be unpunished than to punish any single innocent.

Forcing suspects to incriminate themselves is organized thuggery, not law enforcement.

Digital crimes are hard to prove as they were and easy enough to incriminate the innocent, with USB sticks of only a few grams and millimeters capable of holding hundreds of thousands of the most grotesque and heineous pictures known to man - and no humanly way for the defendant to prove they're not his/her own. -

Now imagine
- a tiny USB stick found in your jacket after arrest.
- a 4gig blob of /dev/random but an extension .gpg on it.
- you facing 2 years of jail for not revealing a password neither you nor God ever knew because neither you nor Bruce Schneier can prove it is random and NOT encrypted data.

or even without intervention of a malicious police officer who framed you because he's after your wife

- you are the suspect of some crime, for whatever reasons, but you are innocent.
- police search and seize your property, lawfully and with a legal warrant.
- police finds a nondescript CD-R, hidden deep in your closet that contains data that looks suspicious AND encrypted
- it really IS encrypted data which you yourself encrypted. It is raunchy, but harmless (read: legal) stuff from college times.
- you produced this material several years ago, while in college in Alpha Beta Gamma frat and wanted to never ever have your roommates watch it.
- you kept the CD for sentimental reasons and summarily forgot the password and the fact that it ever existed. It was just sitting in the bottom drawer and went along the other stuff when you moved.
- you really forgot the password, in fact, you didn't remember that you even had the CD at all

- when the district attorney presents this CD as exhibit XY, you remember what it was and become nervous because your wife and kids are in the courtroom. You still don't remember the password as it was really long.
- the judge noticed you became nervous and will now never believe any story you tell unless you present the password as proof.
- result: you are innocent, but you are probably facing a 2 year non-commutable sentence for not revealing the password

Hands up who thinks that's a good law.

Re:The logic is obvious

[Anonymous Coward]

So then the resistance they put up will be inversely proportional to the sum of the inverses of their individual resistance? I guess it would ensure that the trial stays current.

I got nothing for voltage...

Re:The logic is obvious

[roggg]

The union of the sets "Animal rights activist" and "Terrorist" is not empty.

Union doesn't mean what you think it means.

Re:The logic is obvious

[Anonymous Coward]

Some animal rights activists do use terror tactics

Yes, but in the UK the definition of terrorism is laughably broad: a peaceful demonstration near a busy road could be enough to class as an act of terrorism - as it could be considered a "serious risk to the health or safety" (of the protestors themselves).

Even if the case never goes to court, this in itself is enough to suspend many of the normal checks against state power, e.g. detention without charge for long periods.

Re:The logic is obvious

[aztracker1]

Yeah, but you should be able to tell your lawyer... Also, compliance with such an action, should exempt you from prosecution on anything they find, since you are protected from self incrimination.

Re:The logic is obvious

[Anonymous Coward]

The union of the sets "Animal rights activist" and "Terrorist" is not empty.

I think you meant intersection.

Re:The logic is obvious

[pipatron]

if you haven't done a certain thing (say, activating a specific bit on a specific offset on the file), would make the file self-destruct by insertion of random data, and if the file was write-protected, it simply wouldn't decrypt

Futile. The police will never work on the original, they will always use a cloned version. All self-destruction options are pointless when protecting against anyone with a bit of knowledge. Works well against the petty thief, but then a 6 letter password works as well..

Re:The logic is obvious

[Cornelius the Great]

The "Reagan defense" would've backfired for Clinton. The only way it would be believable for someone forget that he got a blowjob from someone in particular is if he received a lot of blowjobs from a lot of different people. For Bill Clinton, that does sound plausible, but I don't think it would help his case.

Re:The logic is obvious

[xappax]

You might be interested in the "Animal Enterprise Terorism Act" (AETA), a new US law which specifically targets animal rights activists. It basically defines activities that most would consider protected speech as terrorism, and punishable with long jail sentences - specifically if those activities are connected with animal rights activism. For example, activists in the US are currently being tried under AETA for holding (admittedly loud and obnoxious) rallies outside upscale fur stores and the homes of high-profile vivisectionists while wearing masks. No weapons, nobody harmed, nothing even broken, and yet everyone expects they will be convicted of what amounts to domestic terrorism. They may already have been, I haven't followed it closely.

The lesson here is that just like with child pornography, governments start out using unpopular groups to introduce new repressive methods. If we don't speak up in their defense now, even if we don't care about the groups being targeted, we'll almost assuredly be next ourselves.

Re:The logic is obvious

[jabelli]

Please provide the password for the encrypted volumes "/dev/random" and "/dev/urandom" immediately!

Re:The logic is obvious

[digitig]

Well -- "union" does mean what I think it means, but it doesn't mean what I meant. I meant intersection of course. Although what I typed was still true...

Re:The logic is obvious

[Nocuous]

No. "Burger-boarding" would be strapping them upside down to boards and stuffing meat down their throats in quantity and frequency that they have a legitimate fear of being suffocated to death.

Since they hate meat, this would be the equivalent of what US forces have done to Muslim prisoners; urinate on a Koran or shoot it full of holes, smear fake menstrual blood on the prisoner, AND water-boarding them.

Re:The logic is obvious

[davester666]

Um, 'terrorist cell' is considered much more loosely defined than that. It's more like "anybody within our border, or that we can get another country to send to us".

The first rule of fight (the terrorist) club is assume everyone is a terrorist.

Re:The logic is obvious

[digitig]

Er, yes, I'll speak up for them holding peaceful (albeit loud) protests. But I will not speak up for them sending nail bombs to charity shops. Which category do the ones in this case fall into? Well, we don't know, and that is the issue, not the fact that they're campaigning for what might be seen as a legitimate cause.

Re:The logic is obvious

[InsertCleverUsername]

Funny and true.

Re:The logic is obvious

[xappax]

Fair enough, my point was just that western governments have a proven track record of pulling this type of shit on pretty innocuous individuals/organizations, so it wouldn't be at all surprising in this case.

Nevertheless, I would go so far as to say that even if they are the nailbombing type, we should still demand that they be subjected to the same legal procedures that we ourselves would expect. Which means that under no circumstances should anyone be punished simply for refusing to decrypt allegedly encrypted data.

Doesn't mean they shouldn't go to jail, just not for that.

Re:The logic is obvious

[PinkyGigglebrain]

".. these offenders thrived on the fear they created through threats and intimidation."

Sort of like the governments?

Re:The logic is obvious

[blueskies]

If you are part of a terrorist cell (or a criminal gang) and the police obtain your encryption keys, telling the rest of your cell or gang will enable them to destroy their own compromised data before PC Plod arrives. That is the logic behind the law.

The alternative is to lock up everybody who has supplied keys until any legal case is over, so they cannot communicate the news.

Uh, no? What would make you think there is only one alternative? I mean why even have an open society if you are going to use excuses any time you want to do anything? If you have an open society, people might steal from each other, so we have to be tyrants (that's the alternative right?).

I can't wait until you guys shoot and kill another guy stepping onto the subway. That was a wonderful illustration to these kinds of excuses.

Re:The logic is obvious

[blueskies]

But why punish more people then? So if you didn't happen to get bombed by an extremist, you also get an opportunity to be arrested for having encryption too?

I'm not sure how it is a net positive for people. Is it better to catch a criminal and send 5 other people to jail or to have all 6 of them out of jail?

Re:The logic is obvious

[Anonymous Coward]

No the logic is flawed. Flaw 1. IF I have something to hide, even if I am not allowed to tell. I will have arranged for way's to notify of compromise. Flaw 2. Using double encryption (plausible deniability) I can give you the phony data. Flaw 3. This forces the owner of the data to incriminate him/her self. Flaw 4. ... oh I am getting bored.

Re:The logic is obvious

[digitig]

Nevertheless, I would go so far as to say that even if they are the nailbombing type, we should still demand that they be subjected to the same legal procedures that we ourselves would expect.

No argument. As I said, there's a lot wrong with that law, just not the fact that the people being prosecuted are animal rights activists.

Re:The logic is obvious

[Ironica]

If they're punishing UK citizens living in the UK for acts in the UK normally protected under UK law, then you have a point. But saying "We're not going to allow a citizen of another country to visit us" is a very different situation from such punishment.

Re:The logic is obvious

[rsborg]

I don't think the authorities involved are that stupid.

I'm not scared of stupidity as much as this law effectively allowing witch-hunts (oh, looky here, you have a binary file we can't decypher. Please tell us the encryption key). Add to the fact that you can't disclose your being investigated, and it's just ripe for abuse from very competent but corrupt officials.

Re:The logic is obvious

[Cederic]

Although he was also correct :)

Re:The logic is obvious

[Anonymous Coward]

the point is that these laws are written with terrorists in mind, but end up getting applied to the general public. it's a way for government to abuse power and cover their asses.

Re:The logic is obvious

[Anonymous Coward]

Easy: "Oh, that... I was testing read/write speeds of my hard drive and forgot to delete the file." Just show them this:

dd if=/dev/random of=random.bin count=10 bs=1m

See? Random data and a perfectly plausible reason for having it.

Re:The logic is obvious

[molkov]

This comment is ridiculous - I'm not quite sure how it has been moded up to 5. Taking the "reductio ad absurdum" approach is not clever it just smacks of not having a decent argument. This law is applied in a COURT in which a JUDGE hears arguments from LAWYERS. You hire the latter to argue your case, including the fact that you have forgotten the key (if that was the situation). In such a situation (I bet all), the Police/CPS would be forced to provide evidence that you did in fact remember/know the encryption key - something which they no doubt provided in this case through the bugging of the house. i.e. No-one will go to jail for forgetting their encryption key. Stop being a moron.

Re:The logic is obvious

[microbox]

There are obvious other solutions to this problem. For example, you may be gagged for a period of 2 weeks. The request by the police must be entered as a matter of public record, to be revealed in no less then 1 month. Something like that would make the police think twice about targeting "undesirables". Note that the US wiretapping program has been used to track left-wing journalists. This is what happens when there's no accountability.

Also, consider the absurdity, absolute insanity, on attempting to gag a terrorist cell member with a legal threat. Who are you kidding. A cell member wouldn't blink and eye breaking such a law.

It's a simple as that. The options are to do a 16th century Japan and ban progress, or accept there will be problems en route.

You are soooooooooooooooooo wrong.

Re:The logic is obvious

[Anonymous Coward]

Hands up who thinks that's a good law.

/me raises his hand.

Signed:
The police force (aka the peace farce).
Crown prosecution service.
Prison industry contractors.
Politicians who raise votes by being "tough on crime".
Proprietary encryption vendors (who may have a back door that can be used when necessary, in exchange for money).
People of moral dubiousness who may want to incriminate someone with something.
Legal industry - solicitors, barristers, etc..
Spy industry, both government and private. No encryption makes spying easier, and if encryption == prison then some will be put off using it.
.....

Re:The logic is obvious

[Anonymous Coward]

Isn't it strange how NONE of the media showed us any of the undercover footage obtained inside HLS's 'laboratories' (torture chambers), where clearly sociopathic and sadistic 'researchers' routinely tortured animals on a daily basis. You know - the very reason that the 'evil' 'terrorists' tried to stop them.

The 'offenders' don't "thrive on the feear they created", they wanted to stop the evil psychopaths from torturing more animals.

All vivisection is fraud.
Because ALL drugs and medical procedures that make it to the 'market', first have to pass through HUMAN experiments. Otherwise known as 'clinical trials'. They are still HUMAN experiments - obviously stating that fact would mean that the general public would be uncomfortable with the truth, and would also start asking - why are we doing human experiments, if animal experiments predict human outcomes?

92% of drugs that pass animal experiments, fail human experiments.

Furthermore, which animal did drug 'X' work in? A rat? But not a mouse?
A mouse, but not a guinea pig?
A guinea pig, but not a rabbit?

This is the norm with the majority of drugs - they have different results in different species of animals.
Which species, then, do we use to act as the human model for drug 'X'?

Obviously, we only know which species responds similarly to a human for drug 'X' ONLY AFTER HUMAN EXPERIMENTS ARE PERFORMED FOR DRUG 'X'.

Have a long hard think about this. It's very simple.

Re:The logic is obvious

[Requiem18th]

Of course there is! They refused to surrender their keys, so they must be bomb-wielding, child molesting, fundamentally Islamic animal pirates!

Re:The logic is obvious

[Anonymous Coward]

My name is Mike, you insensitive clod!

Re:The logic is obvious

[dave87656]

If you are part of a terrorist cell (or a criminal gang) and the police obtain your encryption keys, telling the rest of your cell or gang will enable them to destroy their own compromised data before PC Plod arrives.

If you are a terrorist and you are the kind of person who feels it's ok to take innocent lives, I really doubt a gag order is going to stop you from informing your buddies that the encryption keys are compromised.

Re:The logic is obvious

[xaxa]

I'll give you a very simple counter-argument:

Doing research using animals is very expensive. Wherever there's a cheaper alternative, it's used in preference to animals. If you really want to stop animal research the best thing you can do is campaign/raise money for more research into alternatives.

(Also, no one really cares about mice, rats or guinea pigs. Try dogs, monkeys and chimps.)

Re:The logic is obvious

[LQ]

Where the definition of 'terrorist cell' is up to the authorities, and in this case means 'animal rights activist'. It could mean anything according to this corrupt, overbearing government.

Animal terrorists are a red herring. In Britain 3% of the population is Muslim. A poll in 2007 found that 13% of Muslims aged 16 to 24 "admire organisations like al-Qa'eda that are prepared to fight the West". [*] This is a real enemy within and the police need special powers to deal with them.

Re:The logic is obvious

[mpe]

Where the definition of 'terrorist cell' is up to the authorities, and in this case means 'animal rights activist'. It could mean anything according to this corrupt, overbearing government.

Though ironically terrorists (at least in the UK) are far more common amongst "animal rights activists" than amongst Muslims. However it isn't PC to refer to the likes of SHAC as terrorists. Indeed it wouldn't be too much of a surprise if the BBC were to find some other term to refer to the IRA.

Re:The logic is obvious

[damburger]

When did pushing poo through a letter box being compared to blowing people up on public transport become "Interesting"?

Re:The logic is obvious

[damburger]

I am assuming they were activists rather than terrorists, because the government has provided no evidence they were terrorist. You see, unlike the people here so quick to jump on animal rights activists and brand them terrorists, I believe in this old fashioned concept of "Innocent until proven guilty". Maybe thats just me though.

Re:The logic is obvious

[mpe]

Actually the UK has a problem with extremist animal rights activists who do go round bombing things.

Not just in the UK these people are also in other parts of Europe and North America (probably Australia too). In some cases there appears to be exactly the sort of international criminal conspiracy which the "War on Terror" (together with draconian "anti terrorist" legislation) is supposedly about stopping.

Some of these are now behind bars and rightly so.

The obvious problems are that not all of them are where they belong, the "authorities" are reluctant to use the law they claim are needed and the media just won't "call a spade a spade".

Re:The logic is obvious

[mpe]

My wife's boss had death threats and faeces shoved in his mailbox by these terrorists because his company does IT work for the London office of a large Japanese conglomerate with a partly owned subsidiary that was once a supplier (not of animals) to Huntingdon Life Sciences. They use exactly the same twisted mentality as Al Qaeda to justify their attacks on the most vaguely related of targets.

They call this "tertiary targeting". If anything SHAC closer to the fictional SPECTRE (or SPECTRE) than Al Qaeda. Though the fictional entities probably have a better "intelligence staff" and are thus less likely to hit the "wrong target". (The average Al Qaeda operative, at least in the US and UK, appears to be capable of failing to win a Darwin Award. With out even enough of them or an ADC special.)

Re:The logic is obvious

[AP31R0N]

Not all animal rights activits are vegetarian. But yeah, it is funny to think of ways to torment people who care about something.

Re:The logic is obvious

[AP31R0N]

Erm. No, they aren't in jail for senility. They're in jail for something along the lines of obstruction of justice or destruction of evidence (evidence tampering?), disobeying a court order perhaps. Imagine a company whose executives embezzle millions from customers. They commit their crimes on encrypted servers. The cops confiscate the servers, but the conspirators refuse to decrypt THE EVIDENCE. In US law, they might be able to hide their crime under "self incrimination". If i murder someone in my house and refuse to allow the cops in on the grounds of privacy, they'd laugh all the way down to the precinct. Allowing people to hide crimes behind encryption is risky.

It sends a message that A) you can refuse to do what the court tells you and B) that it's OK to commit a crime as long as you encrypt the evidence.

So we must either A) make it a crime, like 'contempt of court' or some such to hide evidence or B) hold people in jail or on bond until we can decrypt the files.

Re:The logic is obvious

[rtb61]

Benefit of the doubt, goes to the defendant, don't try to wiggle or deceive, prove they can not remember the password beyond a shadow of doubt, yeah, like good luck with that or do you claim esp abilities and are assuming the 'we say so' approach.

Re:The logic is obvious

[AP31R0N]

Can someone parse this cluster fuck "sentence" for me? i can't make heads or tails of Mrs. Palin's rambling.

Re:The logic is obvious

[binaryseraph]

My guess is that if you are blowing up facilities in the name of animal rights- you probably do not eat them.

Re:The logic is obvious

[Anonymous Coward]

This is a BS straw-man argument comparable to the "hidden bomb" justification for torture used by the US government. It's probabilistically non-existent as a reality but it will and is misused against regular citizens in both the US and UK.

Re:The logic is obvious

[jabuzz]

I am afraid that you are engaged in some seriously flawed and faulty thinking.

Firstly what you failed to ask is what percentage of drugs that fail animal experiments would pass human experiments.

Secondly remember animal experiments are generally for toxicity not efficacy, i.e. is drug X going to kill or seriously harm the subject. Just because drug X is safe to try on humans does not mean it does anything useful.

Did the drug fail human experiments? Yes. Did the drug testing process fail? No. Human volunteers for taking random chemical compounds are very few and far between. I hope you are signed up for lots of early stage drug tests.

Thirdly different animals are good analogs for different human organs. So a guinea pig is good for heart drugs, and a cat for liver drugs etc. These are made up examples as I don't actually know which animals are used for what.

Finally democratic society has deemed testing on animals acceptable. As a consequence society has the right to punish those who engaging in terrorist activities because they don't agree with animal testing. If you don't like it use the democratic process to change it.

Re:The logic is obvious

[jabuzz]

There is also the case of the guinea pig farmer's mother if I recall correctly, whose body was snatched from a grave and whose wear abouts is currently unknown.

http://www.independent.co.uk/news/uk/this-britain/animal-rights-activists-condemned-as-guinea-pig-farm-gives-up-fight-504066.html

There were also a range of arson attacks.

http://www.guardian.co.uk/uk/2005/jun/25/animalwelfare.world

http://news.bbc.co.uk/1/hi/england/5259774.stm

moral of the story...

[vorlich]

Have nothing on your pc that you would not happily shout across the main high street.

Re:moral of the story...

[am 2k]

Like my tax reports?

Re:moral of the story...

[gardyloo]

"100101000101011111001001000100101000100100001"!

Re:moral of the story...

[Anonymous Coward]

ï½WÃï½ ?

I don't get it.

Re:moral of the story...

[Loquis]

Pervert

Re:moral of the story...

[HeronBlademaster]

Am I the only person to took that to a binary->ascii converter thinking gardyloo was actually saying something?

Re:moral of the story...

[Anonymous Coward]

"100101000101011111001001000100101000100100001"!

Is that the key to time travel, I have just read?!

Re:I know

[Anonymous Coward]

The police "having a really good reason" has nothing to do with it.

If you have random junk on your computer - not even in a file, just random bytes of data scattered on your hard drive - and the police are looking for any reason at all to coerce you into doing something - the ONLY thing they have to do is say ENCRYPTED PARTITION, HAND US THE KEYS. Your jail sentence is signed right there. You are fucked. No recourse. No possibility of defense. No way out. It is the ultimate tool of oppression.

So even if we assume, in this case, the police "have a really good reason", there will be cases where they won't have any legitimate reason at all, but will use this law to intimidate, threaten, coerce, and imprison anybody they want. Police aren't some magical form of life that have morals and values above us mere humans. No, there are plenty of corrupt cops out there, and plenty of misguided ones too. They also act at the behest of politicians with their own agendas from time to time.

I don't care whether or not the people in these cases were being investigated for "really good reasons". The potential for abuse of this law is staggering. One cop says you have an encrypted file, which he may have planted himself - BANG. You are in jail. As fucking easy as that.

Of course, this law was never made to be enforced as a law upholding the rights of victims. It was a law specifically introduced to control and oppress the population. There is no other possible explanation for it.

Oh what's that, you don't like the way I am ruling this country? I have some computer experts that would be mighty interested in taking a... peek at your computer. I'm not sure what they'll find, but they've been known to find all manner of things... I'm sorry, I digress. What were your political opinions on my leadership again?

I'm sorry, but if you can't see why this law is so bad, then you have been brainwashed beyond all help, and should be lobotomised as quickly as possible.

Re:I know

[SeaFox]

Ok, yes there is a chance the person wants to defend their rights and not give their key to the authorities, but it is also more likely the police has a really good reason for prosecuting that person, and the person has a pretty good reason for not giving the key (i.e. he has done crime). That's why they have this law.

That's just another way of saying "if he had nothing to hide, he would have cooperated".
The previous administration called, they want their lame excuse back.

Unless you're Arabic looking

[fantomas]

"As an analogy, imagine a shed in your yard that you keep locked. Law enforcement would, under almost all circumstances, require probable cause or a warrant based on probable cause in order to go onto your property and search that shed."

Unless you're Arabic looking and you and your shed aren't on US land (say in Iraq, or Afghanistan).

In which circumstances they'd blow the side of your shed out, ship you off to a dodgy country outside US jurisdiction, get you tortured, lock you up in Guantanamo Bay for a few years til you go mad, tell you you'll never see your family again if you don't confess, and then ask you to talk. Allegedly.

Very interresting

[aepervius]

Double OTP. The first to encrypt your data into a "fake" OTP that you store somewhere and label "OTP". Then you encrypt something incriminating but not really illegal. Maybe letters to your mistress, or some particularly kinky and/or disgusting habits. I think this can only work well if you additionally can make sure there is no history anywhere : so for example by booting on an OS which can use a RAMdisk without needing a scrap/page file. It might be slow but if you only encrypt/decrypt/use those incriminating doc there, worth it. Each time you want to use them you boot on that ram disk system, "decrypt" your kinky photo/docs, then un-OTP your real doc, use it, change it, then encrypt again with first the real OTP then with the kinky data. Copy back on disk. Make sure you wipe out the old palce where it was as analysis would show you changed your OTP (or maybe make an habit of saying it is a ONE TIME pad so I change it regularly Mr officer).

If you properly do this, it will be wiped from RAM each time, and only the double OTP'd version will stay on disk, not the real one. No history, and perfect disclosure. But you have really to make sure no disk access is written other than what you request to read/write/wipe the various OTP'd file. Otherwise history on your computer will betray you.

Now i would be interested into somebody critizing the process... Just to, intellectually, you know, refine it.

Re:Demand

[TaoPhoenix]

I presume the demand is verbal and not written down. Otherwise a troupe of Citizen Muggers can forcibly take it from you, post it, then give it back.

Better than TrueCrypt

[nmg196]

It seems to me that a better solution than hidden partitions would be a hard drive which had a hardware self-destruct feature. Something like a tilt-switch which detonated a small block of thermite embedded inside the drive. If anyone steals your computer, your drive is screwed. Just make sure your backups are well hidden so they can never be found.

STNG, The Drumhead

[Anonymous Coward]

http://www.youtube.com/watch?v=keZlextkcDI

The US customs are WAAAY ahead on this

[Anonymous Coward]

They can, if they want, just TAKE your laptop.

No need to give it back and they are allowed to look at ANYTHING on it.

Which is why laptops for businessmen are going in by mail rather than with the laptop owner.

And why many businesses do not let their officers into the US for meetings with a laptop AT ALL.

Re:I know

[Fotograf]

can you imagine what he would have to have there illegal where two years would be higher sentence? the law is useless as many similar and touches nobody it is intended to touch while making lot of collateral damage. but... people are not hungry so they don't care and it will eventually pass

failure to decrypt?!

[nimbius]

the price is high, but saying no sends a powerful message. im glad to see at least two folks in the UK standing up for what little rights they have. Thoughtcrime law disgusts me.

Easy enough to avoid...

[Anonymous Coward]

There's an easy way to avoid this legislation: don't store your valuable data in the UK.

The legislation does not cover any data stored outside the UK.

If I were a business or individual who wanted to keep valuable data secure, and avoid this (truly) Orwellian act, I would not store anything in the UK.

Re:Easy enough to avoid...

[Cheesetrap]

There's an easy way to avoid this legislation: don't store your valuable data in the UK.

Or your free space blocks that could be mistaken for encrypted terrorist blueprints. Oh no, you still go to jail!

If I don't hand over evidence

[Anonymous Coward]

I do not have to.

If they don't have enough evidence without me handing evidence over, why are they wasting time and effort trying to convict me?

New Scam

[vlad30]

I'll dress-up as a Government investigator fake badge and all turn up at wealthy guys place and demand passwords/encryption keys etc with a few friends and abandoned warehouse could rake in millions. the potential would definitely worth investment required So how do you really know it was government officials.

Re:I know

[lordandmaker]

Ok, yes there is a chance the person wants to defend their rights and not give their key to the authorities, but it is also more likely the police has a really good reason for prosecuting that person, and the person has a pretty good reason for not giving the key (i.e. he has done crime). That's why they have this law

This was in the UK. Chances are there was not a really good reason for prosecuting that person. We have weekly reports of local and national government abusing loosely-defined 'rights' to surveillance and monitoring.

Had the UK government not already demonstrated a complete lack of respect for individual privacy, I think people would be more likely to feel they were justified in pressing for the passphrase.

This Is Evidence, Not Testimony...

[Anonymous Coward]

Are murderers allowed to withhold the murder weapon? Is it an invasion of privacy for a stalker if the police looks at their phone records?

Likewise, if the police have a warrant, and they demand that you unencrypt the data they have a warrant to access, then why is there an outcry of "Woe is me, my rights have been abridged!"? It is evidence. The police collect evidence, that is what they do. When you try to hide evidence from the police, you get into trouble.

If the police are mistaken, and there is no encrypted data on the media, then you'll have the opportunity to fight that out in court.

If there is encrypted data, but you no longer have the key, at this point, everything is crackable. I think that a good lawyer could maintain your innocence in such a situation - provided you were helpful to law enforcement in every way possible. And the police would eventually get access to the encrypted data.

Good try, but doesn't work

[andyh-rayleigh]

This doesn't work for two reasons:
1) The definition of "key" in the law is essentially so general as to mean all the keys needed to translate the encrypted file into the readable original.
2) GCHQ are certainly competent-enough cryptanalysts to be able to break that - essentially the real key can be extracted by testig each file to which you have easy access ... probably can be done in less than 1 day with modest hardware, much faster with the toys that they have at their disposal.

Andy

Re:Good try, but doesn't work

[aepervius]

I think you misunderstand the point. You offer a file which you MIGHT want to protect, and encrypt it, but in reality the KEY is the one you want to protect and is the encryption with a real OTP. OTP(real data)->Fake OTP ; Fake OTP(kinky data of you)->aliby encrypted data. As far as I know OTP'd data from real random source will not be differentiable from real random data. So sure without KNOWING the original first OTP encryption, a forensic analyst can only go back to the first encryption and get an alibi file which you MIGHT want to hide (yourself with a shoe fetishist or whatever), but the KEY can ONLY look like random data. There is no way to distinguish between real random noise to an OTP'd structured data XOR'd with real random noise. If tehre was , OTP would be reversible and i would like to see you pointing how. So if you take the time and resource to cover your trace by only manipulating your real data onto RAM disk systems, then there is no way an analyst can tell : yeah this bunch of OTP'd random data the suspect pretend is random data, is not random data. You can't.

Re:Good try, but doesn't work

[andyh-rayleigh]

No, if the cops come visiting they will collect every item that could contain a key - they WILL obtain both the pseudokey and the real one (yes, there are lots of places you could hide a micro-SD card - but finding one well hidden will really set off the alarm bells).
Having both they can decrypt the real to the real original.
PC Plod may not be the brightest chap you've met, but he ain't an idiot either. If you have "protected" something with mechanisms disproportionately strong he will get sufficiently suspicious to get a real expert to examone. (Oh, and he is probably only going to have the budget to have your machines properly examined if he is already pretty sure what information is there ... "fishing expeditions" do not make evidence inadmissible in this country - but they do consume scarce resources and thus are difficult for the police to justify to their (budget-holding) superiors).
A cipher system not only needs a secure key, it needs secure methods of handling it.

Andy

Alternative

[TheLink]

Have a reasonably popular O/S give everyone crypto and an encrypted "container" whether they are going to use it or not.

However, it has to be done in a way where you can use that container without leaving evidence behind that you have used it.

Something like: https://bugs.launchpad.net/ubuntu/+bug/148440

Except better :).

Then that's what I call creating real plausible deniability.

Secure

[pagan1]

I have always thought law enforcement and governments had ways and means of cracking most encryption , and then there are all those stories of back doors in truecrypt etc obviously this isnt true they really havn,t got these ability,s ... unless maybe the people in question were using some new powerful encryption algorithm ........

Re:Secure

[Fantastic Lad]

Different levels are at work.

The local police force, the tax collectors and government committees don't all share the same resources. And the super-secret-brotherhood-of-evil in charge of them all doesn't play well with others, so the really high tech stuff is kept up at levels where people are actually quite pleased when somebody decides to bomb a building. At that level, they are more interested in how aware you are and how capable you are of "infecting" others with awareness. Awareness = Choice, and often people choose to stop being slaves. If the controllers consider you a threat to their plans, then it's at that point where you can assume any and all encryption techniques you might be using are useless.

After all. . , anything on our computers that we might want to keep secret had to get onto our computers. --Either we had to download it and review it on screens or with headphones, or we had to key it in ourselves. All of which, if one is under observation, means that nothing put on that computer was secret to begin with since it was sniffed and observed at the source. Do we really think that the super-paranoid controllers are willing to wait around for periods of time during which information they don't know about is able to exist? No way! The whole point of mind-control is that they never lose control for even a moment. That means most of the thoughts one might have were put there by them in the first place, while any new thoughts over which they do not exert control are strictly observed the instant they pop into existence. But the local police department doesn't have that technology at their disposal. They don't have satellites or endless server farms dedicated to calculating which of your Facebook friends you are most likely to fall in love with and through which they can manipulate you should they so desire.

This current story is all about the low-level grunts (police and government and the secret services), and their attempts to impose authoritarian will over the public. They're too thick to realize that they are simply pawns in a meta game designed to create a certain mood, or vibration resonance frequency of fear and loathing in society which serves other purposes they have no inkling even exist.

-FL

Re:Secure

[Anonymous Coward]

Interesting and probably spot on reply ... what intrigues me is the move in the world in general with special mention to Germany and the UK .. and even Australia, towards trying to digitally confine and monitor the individual even to the point of making particular software illegal.There just not enough acts of terror to say it is the trigger, if you look at the big picture you see large western democracies trying to enact ill conceived laws aimed at both the net and the individual .... what is it they are in such a hurry over and seem to fear ? Could it be the free flow of information and ideas...and they fear the Internet could be Sparticus revisited :

and if you genuinely forgot the key?

[moxley]

What if you genuinely forgot the key?

Or, what if you wrote it down and cannot find the slip? If a system truly was just then there should be no way that anybody could do anything about that unless they can prove it's some sort of ruse...Of course we all know that is how you'd be treated whether you were being honest or not.

What if you think you know it, try it and it doesn't work....because you remember it wrong....Your word should be good enough - what are they going to do, torture it out of you? (actually, I don't even want to think about what some of these fascists would try to do if you couldn;t remember your key, but from a legal standpoint I can't see how they could prevail unless they could somehow prove that you were withholding it).

What if you had a folder encrypted and had either genuinely lost the key, or were trying to make it look that way and had emailed the software manufacturer saying "Hey,I have lost my key for this archive, what can I do?" and they email back saying "You're screwed without the key, basically" - could that email then serve to prove your point and cover your ass?

Re:and if you genuinely forgot the key?

[z0mb13e]

I was playing with true crypts hidden partition within a partition option and actually did forget the key (both of them). The hidden partition contained a copy of my mp3 collection and some ebooks, but then I remembered about this law and decided that it would be best if I deleted the encrypted file just incase I was ever involved in a case of mistaken identity or was in the wrong place at the wrong time and someone decided that they wanted to see what was in the file...

'...no I forgot the password. I can't open it. It's just a few mp3s and some ebooks on computer stuff'

'Computers? Are you some kind of computer terrorist? Password or you go to gaol... your choice'

This and a handful of other laws passed in the last few years, plus a lot of liberties repealed have made the uk a weird place to live.

It has just occurred to me that they called a bill RIP (Regulatory Investigative Powers bill) - do you think they were saying RIP (Rest in Peace) to British justice?

If you can find a copy of a film called Taking Liberties then it makes for interesting/worrying watching ( Trailer here: http://www.youtube.com/watch?v=bUsNQkV6o04 ) especially to those who blindly support justice and think the police can do no wrong.

Re:and if you genuinely forgot the key?

[moxley]

Yeah, I feel the same way. The TV addicted sheeple are so willing to give up freedoms people gave so much for just to have the state tell them "we'll protect you."

It's pretty bad here, but the shit I hear coming out of your country makes me really feel bad for you guys.

I have always wanted to visit London so bad - every music biography I had read when I was younger made it seem so cool there, all of these great bands from the 60s on, punks fighting Thatcherism, etc, all of the historical stuff, it had always seemed like a very interesting city... ...Then I hear about 5 year olds being labelled as future criminals and put in databases, and police tactics, brutality and oversealous prosecutions being used against peaceful, cultured protesters that are the same as the stuff the police do here at times, cameras everywhere - total surveillance state, the anti-terror laws that have destroyed your civil liberties just as ours have destroyed ours - and now it seems there is a very definitive Orwellian "Big Brother" vibe going on there....

it's sad what is happening and has happened to our countries.

So is the law worth it?

[TheLink]

I'm also curious to learn whether the law was worth it to the UK people in this case.

Basically: how much worse things could have been for UK people if it weren't for that law, compared to how much worse things could be for the UK people because of this law.

Quote:
Sir Christopher reported that all of the 15 section 49 notices served over the year - including the two that resulted in convictions - were in "counter terrorism, child indecency and domestic extremism" cases.

I thought "counter terrorism" was fighting terrorism? So what was "child indecency" and "domestic extremism"?

Re:So is the law worth it?

[Anonymous Coward]

Well this is England, so domestic extremism means you criticized Islam and child indecency probably means you exposed your child to criticism of Islam. Allah hu Akbar mate!

Re:So is the law worth it?

[TheLink]

Does that explain the "counter terrorism" charges too?

Do not work

[aepervius]

If you really want to build yourself an alibi, they need to extract an extremely kinky and very ambarrassing picture of you. Otherwise you would have no reason to encrypt the data.

Re:Do not work

[Lost Race]

I encrypt lots of data that I have no "reason" to protect. E.g.: TrueCrypt FDE on my notebook in case it stolen from a hotel room or whatever. I doubt there's anything even as salacious as a lolcat on that machine. E.g.: expensive drives that might have to be returned under warranty -- some failure modes prevent complete erasure before return. Basically there's always something somewhere that I wouldn't want to share with the entire world -- it's not illegal or super-secret or anything, it's just private or confidential -- and I'd rather not have to fret about it should a hard drive go missing for whatever reason.

Effectively unbreakable encryption is so cheap any more that there's no reason to use anything weaker, even when you don't really "need" it.

I have plenty of old hard drives lying around now with forgotten FDE passwords or just dumps of /dev/random (which is good for secure erasure). Fortunately I don't live in the UK so I don't have to keep all my data storage fully browsable for the police at all times.

IronKey?

[Anonymous Coward]

https://www.ironkey.com/enterprise

I'm surprised nobody has mentioned this device yet.

Plausible deniability or presumed guilty?

[Suomi-Poika]

What would happen if you co-operate with the persons who are asking the encryption password but you mislead them by telling a non-working password? It is obvious that the encryption will not open but if you persist that the false password *is* correct how anyone could punish you?

"Sir, it is the password I have been using for last twelve years, I don't know why it doesn't work. Perhaps you have damaged the media when you transferred it and it is now unusable?"

I can not think a method how to tell if the statement above is true or false. Encryption doesn't open but the person is co-operating and trying to help with the investigation. Oh well, perhaps they will transfer you to a country where they can waterboard you, and crush your limbs. :)

It looks like that if you want to clog/DDOS the British police just do this:

1. Buy few hundreds of usb memory key chains.
2. Put some random data to all of them and label volumes as "Child porn" / "Al Qaida files" / "MI6 employee register" .
3. Collect some random names and addresses from phone books and make a "README.TXT" containing one identity to each drive.
4. Start "losing" them to internet cafes and other public places.
5. Profit... no, wait, just watch how people start disappearing. :)

The key in your head is protected by the 5th....

[viraltus]

only if it contains self-incriminating information. Thus, a secure password for now on will have to contain numbers, capital characters, symbols and a self-incriminating sentence... something like "I think Michael Moore is right" will do... Cool, Gotta contact Ally McBeal now to confirm my theory.

A few... but not Microsoft.

[Civil_Disobedient]

There are a few encryption systems out there which provide plausible deniability

TrueCrypt does indeed offer such a feature. Not surprisingly, Microsoft's new Windows7 OS, while maintaining the ability to encrypt data, does not hide the volume.

Amusing that this piece of news should crop up so quickly after I just got through trying to explain to someone why the built-in Win7 encryption was half-assed. "Well, why would you want to hide the volume?" asks the idiot.

Because of stories like this.

Authorities reveal their weakness

[Anonymous Coward]

While the privacy infringement and subsequent imposition of penalties is doubtless of foremost concern to anyone interested in individual liberty, what I find most reassuring about this whole brouhaha is that the authorities have revealed their own powerlessness. They cannot get at the data. Period. Imprisonment by unjust or overreaching authority just emphasizes its own impotence, eventually indelibly marking it as unfit for its position.

Those supporting and enforcing these kinds of injustice remain inescapably rooted in the past, ruling through forceful suppression instead of discussion and debate. They create the very risks that generate their fear by deliberately removing avenues of expression for opposing views; specifically, avenues which do NOT generate violent conflict. It remains a favorite agenda-furthering tactic of contemporary despots.

This now obviously unbreakable encryption technology offers free people a way to blind oppressive authority; electronic acid sprayed directly into the prying eyes of unwarranted surveillance. Now, through its own behavior, we all know they are utterly powerless against it. And as the technological reach and power of unjust authoritarianism grows, this fact alone should give heart and hope to every human being on the planet who wants to escape the chains imposed by others.

ritual umbrage

[epine]

I'm stunned, I don't know why, to see people debating this as if this is the first time the issue has crossed their consciousness. News flash: this has been in the public water supply for at least two decades now. It's important, and if you haven't given it some thought long ago, you're not taking life seriously, you're just a woodpusher in the game theory of human realpolitik.

It boils down to a very simple premise: that entropy is a munition.

If you have some large chunk (say 100MB) of random bits in a file on your computer, there is no way to prove that there isn't some password that will decrypt this block of bits into meaningful information. Any chunk of information content which looks like pure entropy can be accused of harboring munitions, if you're trying to hit the preservation of society nerve, or child pornography, if you're trying to hit the righteousness of the flesh nerve (we all care about flesh). Steganography is the art of boiling a thin soup: very small amount of pure entropy hidden in a huge amount of tedious backdrop (say 200GB of licit pink matter).

If you have a large quantity of real physical entropy, there is of course no way to produce a password, and neither is there any way to prove that the entropy is real.

The authorities find this unbearable, so we are now deep into guilt by association. Caught hanging out with random bits, go directly to jail.

Any public discussion of the matter would conclude that our social concept of judicial fairness is incompatible with this new guilt by association model. What kind of society would declare entropy a munition? How would we all go about scrubbing anything that looks like entropy from our electronic records? It's not clear it is possible to comply with the implications of this, even if greater society drank the Orwellian Spook-Aid.

Hence the secrecy. If the spooks destroy 1000 innocent lives in the course of protecting society as we know it, it appears to be a cost we're going to have to bear.

The easy way to cease to think seriously about this is to invoke Stalinist escalation: that 1000 lives is soon 30 million lives.

Don't be so hasty. Sun Tsu beheaded one giggling princess to make every other princess march with the discipline of soldiers. For his needs, one was enough.

The credit industry doesn't work on principles much better than our agents of darkness. The suits have succeeded in labeling credential fraud as identity theft. Note the slight shift in blame here: it's not the design of VISA at fault (which could hardly be worse), it's your fault for offering up your digits in the first place (well, you can't use your VISA card without doing so, but why niggle?)

I hand pieces of information about myself to thousands of institutions. If the information is gathered and used against me, somehow I'm to blame, not the thousands of institutions who regard protecting the sensitive information they demanded from me as a cost center to be outsourced to India.

The great line in Brazil is "Confess quickly, or you'll jeopardize your credit rating."

Our credit system is nearly as arbitrary and secretive as this business of guilt by entropy. Innocent before proven guilty. The credit system is exempt from our normal social protections against slander. Any merchant can file a damaging untruth about me with little basis in fact, few avenues of complaint, and no ultimate liability whatsoever. The rating agencies will then spread this slander around and I can't prosecute them for spreading damaging falsehoods about me, even if I finally prove that the original merchant lied, and no sensible agency would persist in believing the original claim.

If we're not up in arms about the violation of our social norms concerning slander implicit to the credit industry, I don't harbour much hope that cottage outrage in this forum over incrimination by entropy is going to make any dent in the real world.

Stay tuned for the next exciting chapter, where encryption keys are extracte

Re:ritual umbrage

[Fantastic Lad]

I think the ritual is necessary in the same way a regular shaking of the shoulder is necessary to keep one from nodding off.

Keep in mind as well, that the flow of readers here exist at all points on the learning curve.

Nice summary, btw.

-FL

Re:ritual umbrage

[smellsofbikes]

>there is no way to prove that there isn't some password that will decrypt this block of bits into meaningful information.

To be more precise, *every* large random block of information, when XORed with a specific key, is child porn, or nuke designs, or the text of the Bible. It's an equation with two unknown variables. Not only is it impossible to prove that the data isn't illegal, it is possible to prove that any string of data *is* illegal. You just have to choose your key.

The Bible is a string of random data that when correctly XORed, provides complete plans to make nerve gas, just the same as every other chunk of data.

Re:ritual umbrage

[Anonymous Coward]

I was *just* about to make essentially the same post as yours. Now I don't need to. Unfortunately, I don't have any mod points. You deserve a +5 in order for more to understand this very crucial aspect of the issue.

In short: Any sequence of bits, whatsoever, can be transformed into any other sequence of bits, given the choice of transformation method (encryption algorithm, in this case) and transformation instruction (encryption/decryption key(s), in this case.)

Bleh. Now I said the same thing anyway. Sorry. :-P

Anyhow, people, please mod parent up.

A few points perhaps need making

[Kupfernigk]

I have been around, I can tell, a lot longer than you have. I've been in countries with overbearing, corrupt Governments. Item 1, you have no idea what you are talking about. When you've failed to bribe a Mexican official or got involved with Spanish Mafia house building scams supported by corrupt local officials, or fallen foul of a South American or Russian "businessman" then you can post about it. Until then, don't exaggerate.

Item 2, terrorism is defined in UK law, and judges have to abide by that law. The definition is not "up to the authorities". It is made by Parliament. If you don't like the definition, write to your MP, join a political party or a pressure group (there are lots) and do something, don't just whine. And if you are a 16 year old posting from your bedroom, William Hague was addressing a Party conference at 16, and I was visiting Parliament several times a year at the same age. You have no excuses. We have senior MPs who get it - David Davis, Chris Huhne.

Item 3.Others have made the point that the UK has had animal rights activists every bit as bonkers and dangerous as US anti-abortion or anti-gun-control activists. But the point also needs to be made that law must be general and not have exceptions. Exceptions make bad law. If we start deciding who is or who is not a terrorist based on anything other than their actions and intentions, this is very dangerous for civil liberties.

Although I think this is an unfortunate law, it is difficult to see how it could be any different. What is your proposal to prevent organised crime using encrypted media to conceal their activities? Unless you can point to a workable alternative solution, you are just ranting.

Re:A few points perhaps need making

[instagib]

If there ever was an insightful comment about forum rage, it is this. Mod up please!

The fact that most politicians are inept concerning IT is no logic reason to generally doubt any and all of their decisions. If a security related prosecution affects a suspect's information, so be it; it's irrelevant if this information is a hidden key, an unknown deposit box, or encrypted data.

(BTW, didn't know that Spanish housing scams are Mafia level crimes. Sure do know the others...)

Re:A few points perhaps need making

[Anonymous Coward]

Liberty over safety. If we need to sacrifice our ability to fight organized crime to protect our privacy, then fine. It's worth it.

Re:A few points perhaps need making

[jonaskoelker]

What is your proposal to prevent organised crime using encrypted media to conceal their activities?

Here's mine: do nothing.

The people who value honest citizens' right to privacy over the police's ease of catching bad guys will probably be in favor. And it doesn't even have to be an absolutist question: people who favor (something close to) the particular trade-off between privacy and police efficiency enabled by a hands-off policy will be in favor.

But those people might not be the most numerous...

Unless you can point to a workable alternative solution

I will assert that "do nothing" works. It just works at something different which according to some [who?] is more valuable.

Re:A few points perhaps need making

[jamiethehutt]

The definition is not "up to the authorities".

Local authorities in the UK defined 955,000 as potential terrorists and searched them under the stop and search laws in 06/07. As far as I see it it's the officers and officials that enforce those laws who decide the definition. I mean if they don't arrest/search someone then they've defined them as NOT a potential terrorist and if they search them under stop and search then they've HAVE defined them as a potential terrorist.

When 169 of those stop and searches were investigated 88% were found to be unfounded and when the definition of a terrorist/suspected individual in law so all encompassing I find it quite incredible that only 12% were founded. You know it almost sounds like they maybe getting creative with their interpretation of the definition...

I got my stats from here:
http://www.independent.co.uk/news/uk/crime/steep-rise-in-stop-and-search-complaints-941727.html

Re:A few points perhaps need making

[Cederic]

My proposal is to repeal a law that lets people be locked up for failing to provide an encryption key for a file that may or may not be encrypted and that they may or may not actually have a key for.

The law as written merely requires the police to _believe_ a file is encrypted, not that it actually is. Similarly, you have to prove that you've destroyed a key to be able to avoid producing it, so if you've lost it, destroyed it without retaining suitable proof of destruction or never had it in the first place, you go to jail.

I don't find it remotely difficult to see how the law could be different. Unfortunately my MP is a cunt, the current Government is full of cunts and political protest is having fuck-all effect. If I visit parliament I'll get arrested, because apparently it's illegal to hurt the corrupt fuckwits sat in the Commons chamber, and unfortunately that appears to be my only available option.

Re:A few points perhaps need making

[kylemonger]

Although I think this is an unfortunate law, it is difficult to see how it could be any different. What is your proposal to prevent organised crime using encrypted media to conceal their activities? Unless you can point to a workable alternative solution, you are just ranting.

There are several alternatives, and law enforcement in the U.S. at least is already using them. Keyloggers. Wiretaps. Hidden cameras. Infiltration of suspect groups. If your case hangs on an inscrutable brick of encrypted data, you didn't have much of a case to begin with.

Re:A few points perhaps need making

[Anonymous Coward]

I have been around, I can tell, a lot longer than you have. I've been in countries with overbearing, corrupt Governments.

Too old to count, huh. But you have so much more experience, we will defer to you.

And yet:

And if you are a 16 year old posting from your bedroom, William Hague was addressing a Party conference at 16, and I was visiting Parliament several times a year at the same age. You have no excuses

Make up your mind!

Re:I know

[swilver]

Ah yes, you are another one of those people who think that if the authorities have "a really good reason", then it should be enough.

I prefer evidence.

Revolution

[sadler121]

Let me be the first to say, damn, I sure am glad my ancestor fought the British and won their independence. Granted, it is only a matter of time before we are required to do the same thing here in the US. Thus far US courts have found that giving up a passpharse to an encryption key violates the 5th Amendment right to not self-incriminate. But that hasn't gone to the Supreme Court yet, which means it is only a 5 v 4 decision away from requiring everyone to divulge their encryption keys to law enforcement.

Re:Revolution

[Anonymous Coward]

yes it sure is great to be an American were we are still free. Let freedom ring!

Re:I know

[smolloy]

I don't care whether or not the people in these cases were being investigated for "really good reasons". The potential for abuse of this law is staggering. One cop says you have an encrypted file, which he may have planted himself - BANG. You are in jail. As fucking easy as that.

Sure, but isn't that the case already? Aren't there lots of other laws that can be abused in exactly the same way?

Perhaps the corrupt cop "found" a stash of meth in your car. Perhaps they "found" kiddie porn on your laptop. You're just as much in trouble as you would be if the "found" an encrypted file.

What abuse does this law allow that isn't already possible using other laws (and please don't flame me for going against the flow here) ?

A good legal strategy for the guilty

[Anonymous Coward]

Refusing to hand over keys -- max 2 years. Child pron on computer -- average 3 years.
Refusing to hand over keys -- max 5 years. Planning a terrorist act -- average 15 years.
Crypting the hard disk and refusing to hand over the key looks like a good option.

Re:A good legal strategy for the guilty

[rantingkitten]

Once the authorities figure that out they'll just raise the penalty for refusing to hand over your keys. I predict something absurd, like: "Look buddy, make this easy on yourself. We know you murdered the guy, but if you get convicted for that it'll only be fifteen years. If you don't give us the key, though, you're looking at thirty. What's it gonna be?"

Excuse me?

[BenEnglishAtHome]

Bad examples make for bad arguments. You broadly characterize "anti-gun-control activists" as "bonkers and dangerous".

That's not a good analogy. There are lots of folks on slashdot who understand that "pro-personal freedom" == "pro-owning the means to engage in justifiable violence". We're as rational and peaceful a bunch as you're ever likely to encounter.

Please be mindful that using bad analogies tends to render less impactful your otherwise insightful statements.

Re:Excuse me?

[Anonymous Coward]

Please be mindful that injecting your own views on a completely different issue helps no-one.

The fact is that there are "bonkers and dangerous" anti-gun ownership/abortion/animal right/pastafarian/terrorist/libertarian people around is the parallel being drawn. I'd prefer not to get blown up, no matter who does it.

Re:Excuse me?

[Anonymous Coward]

I have no problem with ANYONE using encrypted media to conceal their activities. Banks do it, private companies do it, and individuals are welcome to as well, and any terrorist with a brain should be encrypting if they intend to do anything in private. Forcing someone to incriminate themselves however, i do not agree with. Let them chat in secret. Punish them for the damage they cause others. Just because you believe someone has intentionally done something harmful, does not negate their right to privacy. IF they truely have done something harmful, there will be evidence of such. Use that to get a verdict instead. This is why the US established the rule "innocent until PROVEN guilty"
Like it or not, it's there to provide you protection.

Re:Excuse me?

[BenEnglishAtHome]

Please be mindful that injecting your own views on a completely different issue helps no-one.

Exactly my point. Thanks for backing me up on that. The GP wrote a mighty good post; it's too bad he weakened it by injecting his view that all gun owners and anti-abortionists are bonkers. As I said, bad examples make bad arguments.

Re:Excuse me?

[Lunzo]

I personally read it as some gun owners and anti-abortionists - which I'm sure you can agree is true. You have examples like pro-lifers killing doctors who perform abortions and the NRA holding rallies in Columbine the day after the massacre. In the latter case it's their right to do so, but its a pretty dick move so soon after the tragedy.

Keys No Problem

[mistralol]

No Problem i will give you the keys. But you dont mention anything about the encryption algorythm how its used / read or implemented. so they still will be unable to read the data. consider the following: You also need an offset to the filesystem header. Does this classify as a password / key? You store your encrypted data in a scambled format eg interleaved to make it harder to read with standard tools. You come up with some complex block allocation scheme which requires part of this fomula to be entered. eg like a more complex reed solomans implementation but you inject errors into the valid data to start with so it looks scambled. When they then tell you the keys are invalid and your going to jail you can then prove otherwise. Since they actually fail the read the encrypted data off the block device correctly in the first place. I suppose they would just re-write the law again and call it encryption in this so called free world ...

Wow. You really are naive, aren't you?

[BenEnglishAtHome]

...if the authorities have a search-warrant,... When they ask, you're supposed to open the doors, lockers, safes, etc...

No. By opening anything, you've demonstrated to the police that you are capable of opening that door, locker, etc. You've now thrown away any defense that relies on the idea that you don't have access (or easy access) to that space. Just by helping the search, you've implicitly provided self-incriminating testimony.

If a search warrant is being served at your location, you cannot know that you are not under suspicion. In that case, you do not talk to the police and you do not help the police in any way. Period.

The correct response when they ask is to not respond at all. You've already (if you're smart) advised the police that you will not be answering questions or assisting in the search. Now go sit in the corner, shut up, and don't move except to shake your attorney's hand when (s)he arrives.

IANAL, etc.

Alright Sony

[AmigaHeretic]

Hand over the Blue-Ray keys.

This is my password for TC...

[d474]

(my password: "ForThe100thTimeFuckYouIWillNotTellYouMyPasswordEver")

British Police: "Tell us your password."
Me: "For the 100th time, fuck you, I will not tell you my password ever."
British Police: "Oh, you want to be cheeky? Tell us your password or you're going to prison!"
Me: "For the 100th time, fuck you, I will not tell you my password ever."
British Police: "This is a matter of bloody national security, you'll get 5 years!"
Me: "For the 100th time, fuck you, I will not tell you my password ever."
British Police: "He refuses to submit, send him to jail!"
Me: "Great, I'll see you in court. You recorded that conversation, right?"
British Police: ???

Doesn't work

[Anonymous Coward]

The police (actually the csi person), will first backup your HD and *then* ask for your key. If your provided key deleted the data, you are beaten up with a stick, restore backup and GOTO 10.

hehe

[Anonymous Coward]

-----BEGIN PGP MESSAGE-----
Version: GnuPG v2.0.11 (GNU/Linux)
Comment: Use GnuPG with Firefox : http://getfiregpg.org/ (Version: 0.7.8)

jA0ECQMCsKcP6wfPDoxg0loBWWLKcbIxLwk35Vu8Lu6+Fldnq64aqGPosMh/h1r8
IB3uDEi+UAc8JgDqZYL18qYLzQazbRDz4MZySZg/CRKf7R13UWWqbHr8fCPyyEcI
RiIXV6Qgw/US76w=
=ZYx8
-----END PGP MESSAGE-----

Incompetent Criminals

[Anonymous Coward]

What is your proposal to prevent organised crime using encrypted media to conceal their activities?

I'm not sure it is possible. As has been so clearly demonstrated recently in the UK, those guilty of organised crime actually make the laws and force others to "encrypt" the data for them. They only reason they got caught out is because they couldn't even do that competently.

....and before you complain that I'm just whining and should sign up to join the system the problem IS the system. After this last scandal I simply do not believe that it is possible to fix the system from within. Like a once grand but now condemned building there comes a time when patching things up will no longer cut it and you need external intervention to replace the major load bearing infrastructure before the whole thing collapses and hurts a lot of people inside.

Are you a programmer?

[sanosuke001]

rename your encrypted volume to "core"

or for non-programmers, "pagefil.sys"

Re:What Britons want

[Anonymous Coward]

This is a very, very bad day for the British public.

I've lost count of the number of times I've seen this kind of statement on /. over the last decade.
When, exactly, will a few million of you blighters do something about it?

RTFL (read the fscking law)

[speedtux]

Item 2, terrorism is defined in UK law, and judges have to abide by that law. The definition is not "up to the authorities". It is made by Parliament.

Instead of pontificating, why don't you just actually read the law. There is a disclosure requirement if:

(a) in the interests of national security;

(b) for the purpose of preventing or detecting crime; or

(c) in the interests of the economic well-being of the United Kingdom.

Those provisions are so vague that police can require you to disclose encryption keys for anything at any time.

What is your proposal to prevent organised crime using encrypted media to conceal their activities? Unless you can point to a workable alternative solution, you are just ranting.

The purpose of this law is not to prevent covert communications because that is impossible in principle.

The purpose of this law it's to give the UK government additional means to force people to obey the government even in areas where the government otherwise has no cause or legal means of forcing you. It's a totalitarian law forced through parliament under the pretext of crime and terrorism prevention.

Re:RTFL (read the fscking law)

[Anonymous Coward]

Agree. No problem to find a way the silly law can not deal with.

- Store the encrypted data somewhere else
- Use systems that "wipe" data if compromized
- Deniability containers
- Software runs in the cloud, data local.

Besides most of the sensitive material I have seen is discarded as soon as read (burn after reading)

Silly law!

Re:RTFL (read the fscking law)

[Anonymous Coward]

As a specific example of the misuse of definition of terrorism in England, check this out http://news.bbc.co.uk/1/hi/uk_politics/4292342.stm

Basically, in 2005 an 82 year old activist (member of stop the war coalition) shouted "nonsense" during a speech by the then foreign secretary in the Labour party conference. He was then removed from the conference. When he tried to enter the conference in the next day he had his pass removed and he was detained under the Terrorism Act.

Fascism in practice

[Anonymous Coward]

A fundamental right in any democratic country, is the right not to provide any information that may be self-incriminating. British law now runs contrary to democratic principles, so therefore the UK is now a fascist state (as we all know, the UK population is the most monitored on earth, so I doubt that this is a surprise to anyone).
British people must rise up, and overthrow the fascists, by whatever means is necessary. It is not sufficient to just attack regime members cars! The regime members can afford lots of private security, and enough 'second homes' that we'll never know where they are.

Arise, ye workers from your slumbers,
Arise, ye prisoners of want.
For reason in revolt now thunders,
and at last ends the age of cant!
Away with all your superstitions,
Servile masses, arise, arise!
We'll change henceforth the old tradition,
And spurn the dust to win the prize!

Re:What I want - that won't help

[Anonymous Coward]

If the police are even slightly competent, they will try you key on a copy of your hard drive.
If it deletes the data, they will still have the original, and not they will be mad.

Thank God that can't happen here (US)

[Anonymous Coward]

Since the 5th amendment bars you from being compelled to testify against yourself, you cannot be compelled to aid the prosecution or to provide the evidence for them.

Another example is, if the authorities obtain a search warrant for your home and find a locked safe, you cannot be compelled to open it for them, but they are free to break into it.

Encryption is no different. They are welcome to try to decrypt it, but they cannot compel you to relinquish your keys.

Re:Thank God that can't happen here (US)

[joe_n_bloe]

Of course you can be compelled to open your safe. Refusal is interfering with an investigation, obstruction, subject to contempt citation, et cetera.

And in the case of encryption keys where there is a valid warrant (which won't be issued for an open-ended "we think something illegal might be there but don't know what" request), the situation is the same. You aren't testifying against yourself when you surrender evidence, in the case that the state can make a reasonable argument that it knows where and what the evidence is.

The state can't compel you to "give us everything you have so that we can look for something illegal, even though we don't know what to look for or where it is." That's an entirely separate issue and is both an illegal seizure and, if related to a prosecution, possibly a Fifth Amendment violation as well. In other words, the state can ask and require you to cooperate in this situation:

"We have reason to believe that the computer you possess that contained numerous references to bomb-making materials and which we seized as part of your arrest for illegal possession of destructive devices CONTAINS encrypted files with additional relevant information. What are the encryption keys for this data?"

The state can't ask you to answer these questions:

"Have you ever been involved in terrorist activities?" (-- self incrimination)

"Do you have any data in your possession that relates to terrorist activities?" (-- also self incrimination)

"Although we found no evidence of terrorist activities when we conducted a search of your home, and no one in the investigation mentioned your involvement, we wonder if there might be evidence of illegal activities hidden on your computer. Give us the encryption keys." (-- no probable cause)

"We have been searching every 10th computer brought into this Federal building as a matter of routine. Give us the encryption keys." (-- no probable cause although you could be refused entry in most cases.)

Large keys on dubious media

[sabt-pestnu]

Given that the lifetime of a CD-R is relatively short in the first place...
Given the problems that various CD drives have (on occasion) in reading CD-Rs made by other drives...

with apologies to Stan Freberg and Billy May...
What kind of nut would you have to be,
to lock up your data with a secure key
only to find out
bit-rot had got inside

(It's a small disk, now and it's always been...)

The logic is obvious...but the conclusion is....

[teambpsi]

Uhm....if you are clever enough to use encryption -- I would also think that you would already have an encrypted code-word or phrase that you would use to notice your pals that you've been compromised ???

You're not going to run out and say "hey I'm being forced to give up my keys"

You'll instead tweet out something like "I prefer Mr. Pibb over Dr. Pepper". Because OBVIOUSLY something has gone horribly wrong......

Re:I know

[Cheesetrap]

Perhaps the corrupt cop "found" a stash of meth in your car. Perhaps they "found" kiddie porn on your laptop. You're just as much in trouble as you would be if the "found" an encrypted file.

What abuse does this law allow that isn't already possible using other laws (and please don't flame me for going against the flow here) ?

Except in this situation he doesn't have to actually plant anything, he can just imagine it's there. The officer doesn't have to commit a crime (case tampering or whatever you'd call planting evidence) to throw you in the slammer *without* evidence.

And a file called xxx.truecrypt

[krischik]

And fill it with not to offensive pornography. Of course in Britain that would be rather dull stuff.

For deniability you have to present something highly embracing but not illegal as well.

Martin

Revoke?

[Anonymous Coward]

Maybe I'm missing something here, but it seems like one could surrender one's key to the government, then revoke that key and generate a new one. If them come knocking again, just repeat the process. It does not seem like one is violating the law by doing so, and it makes it impossible for the government to keep up. What are they going to do? Ban the revocation and generation keys?

Re:I know

[smolloy]

I don't understand that.

If he didn't plant an encrpyted file, then the defence lawyer could demonstrate its lack of existence during the trial.

The corrupt cop would still have to commit a crime (planting of the encrypting file) in order to lock you up. Just as in the case of him "finding" a stash of meth in your car.

I don't understand what leverage this gives the corrupt cop that previous laws haven't already provided.

(Thank you for not flaming ;) )

Re:I know

[Cheesetrap]

Because you can demonstrate that the bag of bicarb in your boot is not meth, but you can't demonstrate that the random block of free space on your computer is not an encrypted video tutorial on how to build a nuke, delivered by a masturbating 14yo al-Qaeda operative.

Nothing has to be planted. Assertion that a crime has taken place is all that is required. In an extreme case, accusation=conviction (if the law is applied to the letter)... not good.

I'm so glad I'm not from or in UK

[Anonymous Coward]

- Hey, what are you in for?
- I stole a car and shot a man in the chest, and you?
- I forgot my computer password.

Sucks to be in the UK

[Anonymous Coward]

Everyday it seems like the UK government is more and more invading private citizens life. I don't think they know what the word privacy means anymore. A camera on every corner, sent to jail for not decrypting your data. This is just crazy. So I wonder, if a suspect has something locked up in a safe, and refuses to open it can they be sent to jail for years + fines, or will the police just do what they can to open it? Same rules should apply to either situation. I'd be tempted to say no I'm not going to help you, just to be contrarian.

Re:I know

[smolloy]

I think you misunderstood me.

Case 1: Cop plants real meth (not bicarb) in your car. You have to explain it (i.e. prove the cop committed a crime), or go to prison for a while.

Case 2: Cop plants data file filled with random data on your laptop. You have to explain it (i.e. prove the cop committed a crime, or prove it isn't an encrypted file (impossible)), or go to prison for a while.

In both cases the assertion of a crime is not enough (in case 1 he has to plant real meth in your car, in case 2 he has to plant a random file on your hdd), and in both cases the cop has to commit a crime (tampering with evidence, or whatever) in order to put you away.

I still don't understand what powers this new law gives to a corrupt cop that don't already exist.

I can legally challenge this!

[NSN A392-99-964-5927]

Well let me break the Official Secrets Act 1968 (hardly logged) to 1989, modified 1990 and terrorism act 2006. I will leave my data unencrypted on trains, I might work for Mi6, but you will never know. I might work for some secret military base in Cyprus. With Nuclear missiles. I might leave data that is unencrypted in the hands of the KGB, I could be on the CIA payroll and a Double Agent or just a /.er :) The point is clear Ladies and Gentleman. I should legally break the official secrets/terror act and let you know where our Trident Submarines are right now including co-ordinates and the names of people who have the keys and how to contact! /MOTD "I have got the key, I have got the secret". Take a leaf out of Pink Floyd's book "hey teacher leave the encryption alone" :)

Re:I know

[Cheesetrap]

I think you misunderstood me.

Nope, I'll demonstrate:

Case 1: Cop plants real meth (not bicarb) in your car. You have to explain it (i.e. prove the cop committed a crime), or go to prison for a while.

Parallel to this law: Cop doesn't plant anything, points at the empty boot of your car, says "that's an invisible, odourless, dimension-shifted bag of contraband we can't touch, see or otherwise detect, but I think it's there and you've just hidden it beyond the ability of our tools to reach! Get 'im, boys!"

Case 2: Cop plants data file filled with random data on your laptop. You have to explain it (i.e. prove the cop committed a crime, or prove it isn't an encrypted file (impossible)), or go to prison for a while.

In both cases the assertion of a crime is not enough (in case 1 he has to plant real meth in your car, in case 2 he has to plant a random file on your hdd), and in both cases the cop has to commit a crime (tampering with evidence, or whatever) in order to put you away.

I still don't understand what powers this new law gives to a corrupt cop that don't already exist.

And now after this law:

Case 1: Cop doesn't have to plant anything, just points at random block of free space "That's an encrypted hidden partition, get 'im boys!"

Case 2: Cop doesn't have to plant anything, points at that test container file from an encryption program you ran a trial of a year ago and forgot about, it might contain a text document with your CC# or something and that's all, but Mr. Poh-leece-man can up and assert "Omg, encrypted kiddie porn! And encrypted nuke schematics! And encrypted blueprints for the White House with drawings that say 'execute tha prezadent here'! Get 'im, boys!"