Slashdot Mirror
British Teen Jailed Over Encryption Password
An anonymous reader writes "Oliver Drage, 19, of Liverpool has been convicted of 'failing to disclose an encryption key,' which is an offense under the Regulation of Investigatory Powers Act 2000 and as a result has been jailed for 16 weeks. Police seized his computer but could not get past the 50-character encrypted password that he refused to give up. And just to get it out of the way, obligatory XKCD."
Pfft, Britan. Glad my ancestors were smart enough to split that dive and setup someplace safe for me to live....
"When I am king, you will be first against the wall..."
But it's hard to remember all those special characters after they beat you with a wrench. Be sure to choose a password that's easy to remember under bludgeoning to limit the number of times they have to hit you in the head.
This one's tricky. You have to use imaginary numbers, like eleventeen... --Hobbes
I wonder what he is hiding.
He's getting off easy. In the USA, the cops would get a court order and the judge could order him jailed for contempt of court until he gives up the password.
You don't have the right to keep your safe locked if there's a warrant for it to be opened. You don't have a right to not provide your fingerprints or DNA if that evidence is appropriate to the case and a warrant is issued.
You have a right to refuse to testify. This only extends to your own testimony, not to everything about you.
Oliver Drage, 19, of Liverpool, was arrested in May 2009 by police tackling child sexual exploitation.
Well, I guess that makes it okay, then. After all, we can't allow people accused of child sexual exploitation to be free, can we?
On a more serious note, this sucks.
Det Sgt Neil Fowler, of Lancashire police, said: "Drage was previously of good character so the immediate custodial sentence handed down by the judge in this case shows just how seriously the courts take this kind of offence.
"Computer systems are constantly advancing and the legislation used here was specifically brought in to deal with those who are using the internet to commit crime.
"It sends a robust message out to those intent on trying to mask their online criminal activities that they will be taken before the courts with the ultimate sanction, as in this case, being a custodial sentence."
I guess insisting on your privacy is taboo now. Even if you're a good kid, if you refuse to let the police into your private files just on principle, you're boned.
i know this is slashdot, and we dont RTFS, but come on!
Actually, everyone has it everywhere. What varies from place to place is whether the government recognizes the right and refrains from violating it. This is true of all human rights.
Don't you have the right to remain silent, so as to not incriminate yourself? We have it here in the US.
No. That right was removed about 10 years ago.
Now, if you refuse to answer questions during your arrest and questioning, the prosecution are allowed to use that silence as circumstantial evidence against you.
They can cut the safe open, you can say you forgot the combination. Forgetting is legally great, Reagen forgot iran-contra and look how that turnout for him.
Short answer: No. Through some creative legal thinking producing your encryption password is now considered equal to handing over the key to your safe, not to compel information from your mind. It's bullshit but Britain takes 1984 as a role model, not a warning.
Live today, because you never know what tomorrow brings
He would have died eventually in any case though, I suspect.
Maybe some cops see it that way... but videos such as http://www.youtube.com/watch?v=i8z7NC5sgik would have me believe that it's always a good idea to plead the 5th and refuse to say anything. It's related to the idea that refusing to consent to a search without a warrant shouldn't be allowed as evidence that a warrant is necessary ("If he has nothing to hide, then he wouldn't mind us looking around..."). What's the precedent where pleading the 5th has been considered a crime? I can see how refusing to talk would get cops to find something to charge you with and arrest you, since it's annoying for them, but when has it been used as the actual charge for an arrest?
Of course, the UK is not unique in much of this. But what makes these examples so sad for me is how the UK was the foundation for much of what one might consider Western freedom. It fought the good fight against totalitarianism (let's not Godwin this). I don't think those who struggled back then would consider all this to be what they were struggling *for*.
Will this constant erosion of freedom ever stop?
No person (...) shall be compelled in any criminal case to be a witness against himself
A.
...I don't see this a "self-incrimination" issue...
Your neighbor spits on your lawn.
This really pisses you off.
You make a detailed journal entry (which you keep encrypted) about how much you hate your neighbor and you want to shoot him.
Your neighbor gets shot.
You still want to show them your data?
B.
You arrive home and find your neighbor's wife's dog (who continually craps on your lawn) has been slaughtered and hung like a side of beef in your bathroom.
You call the cops even though you're an obvious suspect.
They ask you a few questions and want to examine some of your stuff, including your computer.
They find that your computer has been encrypted (not by you).
Will the law think it's likely that someone encrypted your computer, or will they think that you don't want to share the data?
Neither of these are even remotely likely, but that's what the law has to account for: the possible.
Or more recently, Alberto "I do not recall" Gonzales.
I am officially gone from
So only rich people have privacy?
Seems like that could be improved, why not just make being poor a crime?
Well, they can also say: -Tell us where the body is. If you don't tell us where the body is, we'll throw you into the slammer.
You'll tell me that it's not the same thing because if you didn't kill anybody you wouldn't know about the body's location and that if the kid is hiding child porn on his computer and is not 'telling where the body is', he must be guilty then.
But it is the same thing is there is no child porn on that computer just as well. If you don't have any child porn on your computer you are innocent of that crime, whether there is or there isn't a court order telling you to give up the password.
So now let's say there isn't child porn on that computer. The judge is still saying: -Show us the child porn on your computer.
If you refuse to show the child porn on your computer (and there is no child porn there) then throwing you in jail for not showing the files is equivalent to throwing your ass in jail for not providing whereabouts of a body of a person, when you have no idea about the body and you are innocent of any crime there.
Not showing them the child porn images on your computer by not providing the password, while being innocent and not having any images of child porn on your computer, and being thrown in jail for that? I say it's bullshit and a violation of your rights. You say on the contrary, that nobody has a right to refuse to help an investigation by providing some information.
--
OK, so you are throwing somebody in jail because they don't want to help you with investigation. Good path on the way of becoming a police state on one hand, on another hand it's an example of a police state in action.
You can't handle the truth.
I think you're forgetting the commerce clause. Specifically the part that says "LALALALALA I CAN'T HEAR YOU!".
Even if a judge ruled that wasn't you testifying against yourself, you could still protect yourself if you simply said "I don't recall that password." You may notice that not being able to recall is used a lot when under oath. The reason is that there really isn't any way to challenge it. We forget shit all the time (hell everyone seems to forget their passwords if my job is any indication). You can't prove someone hasn't. So they say "What is the password and the 5th amendment doesn't protect you," you say "Sorry, I can't recall that password."
See this doesn't work in Britain because they made it a crime not to provide the password period. If you fail to provide it, regardless of the reason, that's illegal. It was a specific law made for passwords. So can't remember? You are boned. The US has no such similar law. Thus the only way they could get you is if you said you knew the password, but refused to give it up, and it was ruled that wasn't protected under the 5th.
However if you look in to it you discover that while there's little case law, indeed it HAS been ruled that that the 5th prevents you from having to give up a password. As such that will probably stay, in general courts abide by the rulings of other courts of competent jurisdiction.
How do you know the encrypted data is related to the case?
How do you know the encrypted data is not something that is, at least to the 19 year old suspect, even worse?
What if he's secretly gay, his entire family are raging homophobes, and he KNOWS beyond the shadow of doubt that revealing his encryption password will get him disowned?
If this was you, would YOU reveal the password?
-=This sig has nothing to do with my comment. Move along now=-
Um. Which is exactly what Truecrypt does, except for the wiping the disc part (Which doesn't work because any good forensics investigator probably clones said disc before attempting any data retrieval, and they won't use your system whilst doing it because they could give you deniability if timestamps change on the disc, and you could booby trap it, but I digress). The hidden volume is accessible by a second password which reads a key from the other end of the container. If you want to write to the outer volume without overwriting the inner volume, you provide both passwords.
The fifth amendment doesn't seem to apply in the courts; to quote his honor, William K. Sessions, Chief District Court Judge in Vermont in United States vs. Boucher:
"Holding that the 5th Amendment privilege against self-incrimination does not require the conclusion that a criminal defendant may elect not to divulge a password for an encrypted hard drive."
It also hasn't stopped judges from using the presence of encryption and unwillingness to give up the keys as evidence of misconduct.
If anything, Britain has stronger protection of individual rights than we have here in the US -- the defendant in this case doesn't risk a dozen years in jail, disenfranchisement and being barred from many occupations for life, like he would over here. I'd take good old Ius Commune over our system.
No this law was written as an ego trip by Jack Straw to prove his power. Among other things it reverses the onus of proof thus taking it outside fundamental principles of British (and US) law. It also goes further an limits the means by which you can prove your innocence, prescribing a few (probably impossible) ways. It also deprives the defendant of the right to a jury trial and gags the defendant from talking about the charge with anyone but his lawyer (and gags the lawyer).
In effect a corrupt government official can send you an encrypted email then demand that you provide the key... As you never had it you can never prove your innocence, so they can lock you up for years after a secret trial.
Add to this another set of laws formed by a radical feminist basically assuming any image of a female that you can't prove is of someone over the age of consent (16) is an image of a child (this includes cached images that may be advertisments that you never intended to view).
So the cops can trawl your computer until they find something you can't prove is legal and lock you up. If you take the precaution of encrypting your PC they can lock you up for that too.
We have now removed these politicians from power however the damage has been done. There are murmurs from some of the politicians about repealing some of the very dangerous laws that were brought in, however they are unlikely to repeal any of the technology based ones. There will be no pressure, the journalists over here consider it a point of pride to not understand technology.
But if you've encrypted the hard drive of your main computer, and you have to enter a password every time you start it... a jury isn't necessarily going to believe that you've suddenly conveniently 'forgotten it'.
I'm going to have to go against the prevailing view on /. on this one. Of course you have a right to encrypt your files so that people can't snoop through without your permission. But I don't think it's a problem that the state can, with good reason, compel you to decrypt it. If the police get a search warrant, that overrides your normal right to refuse them entry to your house. What's wrong with something similar for computers? Or is this just rabid, unthinking anti-establishmentism I smell?
So what happens when you say:
"No,I do not understand. I will need my lawyer to explain this to me"
The reason the courts see it this way is because of the distinction the legal system places on written vs oral evidence. Oral evidence is obvious; the person giving it may or may not be telling the truth. Written evidence however has a more privileged status. Once you've written something down, you can't "take it back". It's out there as physical evidence and can be used against you. This is why even the most gung ho characters will back up if you ask them to put things in writing. The written word is powerful rope with which to hang yourself.
As far as most judges and lawyers are concerned, data on computers is simply another form of the written word, and so anything you've "written" there--encrypted or not--is legitimate evidence waiting to be used against you. In some sense they are in fact right. Personally, I view computer data by its very nature to be more abstract and far more transitory than the traditional written word, and so worthy of less... distinction as evidence in a court. But that said, it is a (quasi-)permanent record of events and that's what courts are interested in.
Bottom line, the old rules still apply. If you don't want to reveal something, never, ever write it down. Encrypting it on your computer is just not good enough. If you don't want people reading it and aren't willing to take a risk, then you either need to delete the data or better yet not write it down in the first place. All that said, encryption is preferable to just leaving your papers lying around, but don't expect encryption alone to magically make your written words disappear.
May the Maths Be with you!
That's why my passphrase is "I committed the crime."
Oops, now I need to change the passphrase on my luggage. Maybe I'll change it to "is my little secret" and when the keystone kops come after me, I'll quip a cryptic comment about Quine.
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
Eh. The Boucher case is a special one, because the idiot was stupid enough to first show his child-porn collection to a law enforcement officer, and then - after the computer was rebooted - refused to provide the password. Initially the state ruled that he couldn't be forced to divulge the password, and in most cases this would hold; however, due to the fact that the presence of child porn on his computer had already been verified, the appeals court ruled that he isn't protected under the 5th. The problem here is that their definition of "already verified" is too loose, because it depends solely on the testimony of the arresting officer(s). Now, if the cops had had the common sense to take a few pictures of the laptop screen, then there would be no issue at all. As it is, if he appeals I'd say he has a pretty good chance of having the decision overturned.
As for the second case, you're talking about a guy who was convicted based on multiple lines of evidence, and is now bitching because the state lawyer happened to mention that "encryption programs" were present on the computer. That's asinine.
If anything, Britain has stronger protection of individual rights than we have here in the US
Thanks for the lulz :)
The really sad part is that I've heard people say Muslims shouldn't have constitutional rights ("they are the enemy"), even if they were natural-born Americans.
Stupid, stupid bastards.
That's exactly what the Germans did - redefine jewish-German citizens as "not german" and therefore executable whenever the government felt like it. And then the US did it in 1942 by defining japanese-Americans as "not american" and locked up 0.2 million of them. Why are we repeating the same mistake in 2010?
"I disapprove of what you say, but I will defend to the death your right to say it." - historian Evelyn Beatrice Hall
Actually they don't even have to do that since after 9/11 nearly 2/3rds of the US citizens officially live in constitution free zones thanks to "protecting our borders in the war on terror" so you might want to look at the map. Live in the orange? then whether or not the constitution applies to you is strictly up to the feds. Scary, isn't it?
ACs don't waste your time replying, your posts are never seen by me.
But if you've encrypted the hard drive of your main computer, and you have to enter a password every time you start it... a jury isn't necessarily going to believe that you've suddenly conveniently 'forgotten it'.
There are other ways to remember passwords other than committing them to memory. I seem to remember hearing about intelligence agencies teaching spies passwords based on muscle memory so that they couldn't be divulged under torture.
I'm a pianist and I've experimented with using passwords based on songs that I know by heart and it works great. My left hand is a bit sloppy, so I just use it on the shift key as if it was the sustain pedal. I had one password that was over 100 characters long and I had no problems entering it in. And even if someone knew the song, it's doubtful they could determine the password since it depends entirely on how I play the piece and which part of the piano key I use for each note. I suppose someone could figure it out by watching me play the piece, but I'm not even sure that would work and I could always play it slightly differently if I knew I was being watched.
If someone is a talented musician, I could see them plausibly telling a jury that they're unsure of the password because they enter it by playing a particularly difficult part of a song. Bonus difficulty points for telling them that the software is time sensitive and expects keys to be keyed in at the same rate as when the password was set.
"Don't blame me, I voted for Kodos!"
I think I'll make my passphrase "I don't remember". That should make for a fun interview.
That article says nothing, and you should be ashamed for linking it. The only fact in the entire thing is that 2/3 of US citizens live within 100 miles of the border or the coast, which is an interesting fact, to be sure, but of no significance to this discussion.
After that, it says, "The government is assuming extraordinary powers to stop and search individuals within this zone," but it cites none of these "extraordinary powers", nor does it cite a single case of abuse of these powers, nor does it explicitly say that any of them are actually unconstitutional. Instead, they resort to shady wording and scare tactics by labeling that 100 mile border/coastal region as a "Constitution Free Zone" on the basis of these uncited and unsubstantiated powers. And their "Fact Sheet" is no better, resorting purely to unsubstantiated claims of wrongdoing which even they admit are being upheld in court.
If this is true, why didn't they cite a single law, a single case, or a single ruling? Not even one. The whole thing reads like a conspiracy theorist paper, except at least the conspiracy nuts can cite examples of these things actually happening. Apparently the ACLU is still working on that.
I believe you will find it in the Magna Carta (MC.29 on http://alexpeak.com/twr/mc/) for an early variation on the concept.
"No freeman shall be taken captive or imprisoned, or deprived of his lands, or outlawed, or exiled, or in any way destroyed, nor will we go with force against him nor send forces against him, except by the lawful judgment of his peers or by the law of the land."
While this was originally intended for the nobles, since the emancipation of the masses, I believe it applies to everybody. However, there may be more recent statues that supersede it, such as European Convention on Human Rights.
Mod me down now and I will become more powerful than you can possibly imagine
These two statements are not the same and your entire argument in this thread relies on them meaning the same thing. In a legal system with formally defined rights they would be the same (ie the US legal system). But in a system of common law there can be principles that are not formally stated.
In the case of this principle, it has been widely stated and incorporated into rulings in the British justice system. As such it forms a part of British law, regardless of whether or not we have a document that "grants" this "right" to people.
Slashdot: where don knuth is an idiot because he cant grasp the awesome power of php
Here's an illegal checkpoint based on that law. here (warning: pdf) is a whole slew of them. This article tells of one specific victim. So does this one. Here's a dragnet for you folks in the UK. This case is the one where they stretched it to include all mail sent anywhere in America. But wait! There's more!
linky
linky
linky
While not specific to the case of searches inside borders based on these laws you may find this link enlightening, it's what our congresscritters are reading about these things.
Warrentless stops and searches inside our borders are being done and it needs to stop.
If video games influenced behavior the Pac Man generation would be eating pills and running away from their problems.
In britain there is no presumption of innocence.
Of course there is. The presumption of innocence in English and Scots law comes from common law. The concept itself has been part of British society for thousands of years - Alexander Volokh says that it has been present since Greece and Sparta and Rome, all the way back to the first (Judaic?) legal systems.
Common law is the basis of the British legal system. Your logic is like claiming that "there is no law against murder in Britain" and then going on to claim that this means murder is legal. English Law - "there is no statute making murder illegal. It is a common law crime - so although there is no written Act of Parliament making murder illegal, it is illegal by virtue of the constitutional authority of the courts and their previous decisions."
It after that went on and voted into the statute book several hundred criminal offences which explicitly postulate that you are guilty until proven innocent. The RIPA act, The H&S act, you name them. Half of Blair's legislation (Blair and Co raised the number of criminal offences on the statutes by more than 100% in 10 years) is based around "guilty until proven innocent".
[citationneeded]. Please name these "hundreds of acts that explicitly say British people are guilty until proven innocent.". And are you seriously blaming the Blair government (which came to power in 1997) for the 1974 Health and Safety Act?!? What?!
So the new government has actually promissed to fix this by accepting _ALL_ rights in the convention and repealing most of Blair's handywork as a big block vote including most of the RIPA act.
Right, that would be the same Conservative party that fully supported the RIP Act then? ('Only a pitiful handful of MPs (pictured below) were present to debate the bill, which was fully supported by the "opposition" Conservative party, and passed by 189 votes to 47 keeping the majority of its original clauses intact.')
This makes no sense in British terms - Parliament is sovereign and cannot be bound.
That said, the centuries old common law presumption of innocence was enshrined in positive law in the Human Rights Act, 1998.
I can't figure out if you are American with a Blair fixation, or British but enamoured of the concept of a written constitution. In either case I think you are misguided:
A written constitution is not "fundamental, nonrevocable and unalienable" since it can be amended, the procedure is just a little more involved than normal legislation. And you only need to look at Prohibition in the US to see that this is no bar to stupid laws that restrict freedom. It also makes them a lot harder to get rid of. Ultimately the cost of freedom is eternal vigilance either way; a citizenry that is either complacent or uncaring of their liberties will lose them in any system, whether or not you have the speed bump of a written constitution or not.
This sig all sigs devours