Slashdot Mirror
British Teen Jailed Over Encryption Password
An anonymous reader writes "Oliver Drage, 19, of Liverpool has been convicted of 'failing to disclose an encryption key,' which is an offense under the Regulation of Investigatory Powers Act 2000 and as a result has been jailed for 16 weeks. Police seized his computer but could not get past the 50-character encrypted password that he refused to give up. And just to get it out of the way, obligatory XKCD."
He's getting off easy. In the USA, the cops would get a court order and the judge could order him jailed for contempt of court until he gives up the password.
"Oliver Drage, 19, of Liverpool, was arrested in May 2009 by police tackling child sexual exploitation"
He was probably suspected of having pictures of his 17-year old naked self on his computer. Quite frankly, I don't give a rat's ass about child porn accusations anymore. If somebody tells me to think of the children, I say "fuck the children" (well, not literally). It's an empty argument, a way of saying "I don't want to discuss this, it's going to happen so shut up." I instinctively assume that anyone who brings up child porn accusations is lying. This is just another instance: They want to read his hard disk, so they accuse him of something unspeakable. The punishment for not remembering a 50 character password after 6 months of not using it is atrocious. These people deserve our deepest disdain. THEY have done wrong and parade their deeds in front of us, while Oliver Drage, for all I know, has not been convicted of anything I would consider a wrong-doing.
No person (...) shall be compelled in any criminal case to be a witness against himself
But is it only 16 weeks, and that's it, or at the end of the 16 weeks do they ask again? If he refuses again do they just put him back for another 16 weeks (or more)?
wha'? where am i?
There are other inferences too, from http://en.wikipedia.org/wiki/Right_to_silence#England_and_Wales
At common law, and particularly following the passing of the Criminal Justice and Public Order Act 1994, adverse inferences may be drawn in certain circumstances where the accused:
* fails to mention any fact which he later relies upon and which in the circumstances at the time the accused could reasonably be expected to mention;
* fails to give evidence at trial or answer any question;
* fails to account on arrest for objects, substances or marks on his person, clothing or footwear, in his possession, or in the place where he is arrested; or
* fails to account on arrest for his presence at a place.
Well, they can also say: -Tell us where the body is. If you don't tell us where the body is, we'll throw you into the slammer.
You'll tell me that it's not the same thing because if you didn't kill anybody you wouldn't know about the body's location and that if the kid is hiding child porn on his computer and is not 'telling where the body is', he must be guilty then.
But it is the same thing is there is no child porn on that computer just as well. If you don't have any child porn on your computer you are innocent of that crime, whether there is or there isn't a court order telling you to give up the password.
So now let's say there isn't child porn on that computer. The judge is still saying: -Show us the child porn on your computer.
If you refuse to show the child porn on your computer (and there is no child porn there) then throwing you in jail for not showing the files is equivalent to throwing your ass in jail for not providing whereabouts of a body of a person, when you have no idea about the body and you are innocent of any crime there.
Not showing them the child porn images on your computer by not providing the password, while being innocent and not having any images of child porn on your computer, and being thrown in jail for that? I say it's bullshit and a violation of your rights. You say on the contrary, that nobody has a right to refuse to help an investigation by providing some information.
--
OK, so you are throwing somebody in jail because they don't want to help you with investigation. Good path on the way of becoming a police state on one hand, on another hand it's an example of a police state in action.
You can't handle the truth.
I wonder how they found out that the length of the passphrase is 50 characters. Did he brag to the authorities? Was there some way of detecting the length of the passphrase when they looked at the encrypted key?
But if you've encrypted the hard drive of your main computer, and you have to enter a password every time you start it... a jury isn't necessarily going to believe that you've suddenly conveniently 'forgotten it'.
I'm going to have to go against the prevailing view on /. on this one. Of course you have a right to encrypt your files so that people can't snoop through without your permission. But I don't think it's a problem that the state can, with good reason, compel you to decrypt it. If the police get a search warrant, that overrides your normal right to refuse them entry to your house. What's wrong with something similar for computers? Or is this just rabid, unthinking anti-establishmentism I smell?
So what happens when you say:
"No,I do not understand. I will need my lawyer to explain this to me"
Theoretically it could be something as innoccuous as a photo of his 16 year old girfriend's boobs (not to mention all sorts of other stuff, like diaries, etc)
The Labour party when it was in power and creating laws out its wazoo (including the RIP Act deployed here) made it an offence to have photos of persons under the age of 18 engaged in sexual acts. To put that in context, you can have a gangbang with a 16 year old (assuming that's her thing) and it's perfectly legal. But if you have a photo of the same girl with her boobs out, taken while you weren't there (!) or if you aren't in a government-sanctioned relationship, ie, long-term or stable (I shit you not) you're a dirty sex criminal.
And that means your life could be destroyed: sex offender's register (probably just for 5 years for a photo of the boobs of a legal to fuck, but not photograph girl) and a bar on any career you might want or develop in all sorts of areas to do with children and 'vulnerable adults'. And maybe any chance of decent employment.
Compared to any of that, even 16 months in prison, after which you at least get to rebuild your life, is probably a price well worth paying. Even for something as trivial as legal-to-touch teen boobs. Or a bit of manga. Or a sexualized stick-figure srawing that some prosecutor might say was 15.
Maybe they think that bikini shot of that cute girl is over-sexualized, and she was only 17 when it was taken...
Maybe it's just regular porn. Or you think so. But get this: you own one picture from a series, which you've never seen. That series of photos contains 'extreme pornography'. Even though your photo doesn't, you still may be guilty of an offence! And stuck on the sex offender's register.
You'd have to be an idiot, assuming the most, er, innocent of porn collections to want to take that risk, hand over your password and place your entire life in the hands of the Criminal Prosecution Service.
Corporation, n. An ingenious device for obtaining individual profit without individual responsibility. - Ambrose Bierce
That's why my passphrase is "I committed the crime."
Oops, now I need to change the passphrase on my luggage. Maybe I'll change it to "is my little secret" and when the keystone kops come after me, I'll quip a cryptic comment about Quine.
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
So he's spending 16 weeks in jail. At the end of those 16 weeks, can they ask him for the password again and throw him in jail again if he does not divulge it?
"May contain" isn't the same as "did contain", and I'd hate to see anyone convicted of a crime he or she "might" have done.
Even if the agent believed it to be child porn doesn't necessarily make it so -- he could have been a Melissa Ashley fan, for example.
Of course, the pr0n might have been illegally copied, in which case it's perfectly valid to not want to incriminate oneself.
I have no idea whether the guy was guilty or not, but I know that forcing him to decrypt his HD in order to find evidence to convict him with is mocking the intent of the fifth amendment.
The problem in that case isn't over the guy's guilt, but that both the judge and the review found that the mere presence of encryption was admissible as evidence against the accused.
It's like arresting someone for arson and using the presence of a ski mask as evidence against him, with absolutely nothing that indicates that a ski mask was used, whether during the crime or to hide his face.
But apparently, possession of encryption software is allowed used as incriminating evidence in itself, and the fifth amendment doesn't cover refusal to disclose encryption passwords.
Yes, we most certainly live in the land of the free. For very small values of free.
The UK has NEVER been a model for any "freedom" as we think of it here. Remember that whole revolutionary war thing? The one we had to fight TWICE just to be free of the King?
Fun times: after saving Europe from the tyranny from the Nazis, Britain went right back to their own tyranny in holding on to the dying embers of the British Empire. Churchill in fact bragged of shooting "savages" in places like South Africa (i.e., he shot black people) in his young days, before his government tortured Barack Obama's paternal grandfather in the 50's during Churchill's second stint as Prime Minister. Which makes it even more awesome when Obama pushes forward in the military trial of a 16 year old child soldier - who's confession was given under....wait for it....torture.
But if you've encrypted the hard drive of your main computer, and you have to enter a password every time you start it... a jury isn't necessarily going to believe that you've suddenly conveniently 'forgotten it'.
There are other ways to remember passwords other than committing them to memory. I seem to remember hearing about intelligence agencies teaching spies passwords based on muscle memory so that they couldn't be divulged under torture.
I'm a pianist and I've experimented with using passwords based on songs that I know by heart and it works great. My left hand is a bit sloppy, so I just use it on the shift key as if it was the sustain pedal. I had one password that was over 100 characters long and I had no problems entering it in. And even if someone knew the song, it's doubtful they could determine the password since it depends entirely on how I play the piece and which part of the piano key I use for each note. I suppose someone could figure it out by watching me play the piece, but I'm not even sure that would work and I could always play it slightly differently if I knew I was being watched.
If someone is a talented musician, I could see them plausibly telling a jury that they're unsure of the password because they enter it by playing a particularly difficult part of a song. Bonus difficulty points for telling them that the software is time sensitive and expects keys to be keyed in at the same rate as when the password was set.
"Don't blame me, I voted for Kodos!"
Make your password "I don't recall my password" and then your not lying just misleading