Slashdot Mirror
Man Jailed For Refusing To Reveal USB Password
judgecorp writes "Syed Hussain, already serving time for helping to plot attacks against UK targets, got another four months for refusing to divulge the password of a USB stick the police and GCHQ wanted to examine. The USB was believed to contain data about a suspected fraud unconnected with national security, and Hussain claimed to have forgotten it under stress, He later remembered it and it turned out to be a password he had used on other systems investigated by the police."
Yeah...
-------
1. Enjoy your job
2. Make lots of money
3. Work within the law
Choose any two.
No, just an ordinary fraudster, not terrorist.
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
No, just an ordinary fraudster, not terrorist.
Hmm, not what the article says. I'm not sure what compelled you to post that.
Yeah, those libtard founding fathers and their prohibition against self-incrimination. What a bunch of moonbats.
Give me Classic Slashdot or give me death!
Another point of the story. Don't reuse passwords :D
The password was $ur4ht4ub4h8 - as Bruce Schneider said a few weeks ago - encryption is still on our side. Regardless of the NSA /GCHQ revelations, they cannot break AES yet. That's why the British police resort to section 49 http://www.theregister.co.uk/2014/01/16/password_refusal_earns_terror_suspect_extra_jail_time/
In not so many flamebait words, yeah.
He knew the password, the police had probable cause, and he intentionally impeded an investigation. I can't speak to British legal procedure, but in America that'd almost certainly be enough to be charged with obstruction of justice.
You do not have a moral or legal right to do absolutely anything you want.
The password he used was the same as one that he had previously divulged, but the incompetent investigators at GCHQ and the police didn't think to try it.
Chalk said the USB contained material linking the defendant to an alleged fraud. He added that it was only when investigators told Hussain he was being investigated for fraud that he gave up the password. Investigations into the alleged fraud are ongoing.
The memory stick did not contain any information on potential threats to national security.
It's right there in the article summary:
Human beings are capable of doing multiple things, and thus getting multiple criminal charges against them, at once. He may well be a terrorist, but this particular story deals with fraud.
What makes you think they hadn't it all cracked, but just wanted to have him spend more time in jail while they prepare the other stuff they will hit him with ? What if he really had forgotten the password ? Beside he had already given them; why would not they have tried all other passwords they had received ?
This is in the U.K.
Some people die at 25 and aren't buried until 75. -Benjamin Franklin
They also accounted for warranted searches. It's not self-incrimination to surrender your shed keys when you've got a naked co-ed chained inside.
I swear to God...I swear to God! That is NOT how you treat your human!
Yeah. It's too bad that US Citizens don't enjoy that prohibition anymore:
http://news.cnet.com/8301-31921_3-57364330-281/judge-americans-can-be-forced-to-decrypt-their-laptops/
There is no 5th amendment by in the UK.
SJWs are the new boogeyman. -Me
Indeed. As the US government operates outside of its constitutional limits, it can only be considered a criminal organization.
Give me Classic Slashdot or give me death!
I'll be in trouble if I'm ever raided -- I have several USB devices and CD-R's that I used in the past to make a backup of something, and have lost or forgotten the passwords.
I wonder what the penalty would be for someone that filled a device with random data, and the authorities are convinced that it's encrypted and demand the decryption key.
From TFS: "already serving time for helping to plot attacks against UK targets"
You didn't even need TFA.
"Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
For the fifth amendment to apply, there must be a risk of incriminating oneself. That depends on the specifics of the case:
Chalk said the USB contained material linking the defendant to an alleged fraud. He added that it was only when investigators told Hussain he was being investigated for fraud that he gave up the password. Investigations into the alleged fraud are ongoing.
If this were an American case, the defendant could be charged with obstructing the investigation into someone else's fraud, but the evidence linking him to it would easily be inadmissible. It's been held in federal court that defendants can be compelled to provide unencrypted drive contents to investigators if the police already know the partial contents of the device. While he could probably invoke the Fifth Amendment to avoid handing over the password, a blanket grant of immunity for anything further found on the device may be enough* for a court to determine that "self-incrimination" is no longer a risk.
* There are conflicting rulings on this recently, implying that there's a threshold for how much immunity is enough to mitigate the risk.
You do not have a moral or legal right to do absolutely anything you want.
I'm more annoyed that the police didn't figure it out based on the password for other systems.
Wow, sent an e-mail as suggested when clicking on "use classic" banner, and got a fast response that addressed my msg
It was a pretty obvious reference to the American Founding Fathers (the UK founding fathers would make no sense in this context) and the US Constitution/Bill of Rights. The fact that it's in the UK means that the American Founding Fathers and Constitution is irrelevant to this story.
As the US government operates outside of my interpretation of its constitutional limits, it can only be considered by me to be a criminal organization.
FTFY.
You do not have a moral or legal right to do absolutely anything you want.
Even so the law was brought in intended for dealing with terrorism threats. Although the suspect was involved in terrorism this specific investigation was not. Therefore this is that police power being used in a broader sense than it had been intended. Got no problem with the guy being sentenced for terrorism or for fraud, but the slippery slope of the usage of this power is disturbing.
Indeed. As the US government operates outside of its constitutional limits, it can only be considered a criminal organization.
Since it defines what is and isn't criminal it cannot, by definition, be a criminal organization. What it can be is unethical, immoral, corrupt, incompetent, unjust, and moronic... but it can't be illegal. People often confuse the word "criminal" with the concept of the "bad person". Ethics and morality have nothing, absolutely nothing, to do with the law. The law is about order. Ethics and morality is about justice. And our justice system has as much to do with actual justice as the military has to do with "peace" keeping.
In every society in which the rule of law has existed for more than a couple generations, it has been corrupted to prioritize order over justice -- and order is another way of saying "remove malcontents and political undesireables". Principally, in an industrialized society these will be young males under the age of 35 who are unemployed, under-employed, sexually frustrated, mentally ill, not eligible for meat grinder service or otherwise producing wealth for the already-wealthy.
Eventually, the law reaches the point where everyone can be a criminal, that the law itself has become and inaccessible bureauacracy, and every action can be rationalized as legal. That point is now, in the UK, the US, and indeed, most of Europe and much of eastern Asia. Every major empire has a historical record of its citizens complaining about overly dense laws and regulations, from modern times all the way back to the Roman Empire, and fragments of literature suggesting an intractable bureaucracy that appeared to randomly punish people as far back as the Akkadian Empire (for the iPod generation, that's about 2300 BC, or about the time Al Gore invented the internet and Jesus rode around on primitive loldinocats).
My point in all this is, it's not a new problem. Arguably, it isn't even a problem: It is in fact the natural progression of all empires and countries. But have hope: It's a sure sign that the civilization has passed its epoch. Within the next 50-100 years, western civilization will start to deteriorate back to a feudalistic-capitalistic hybrid where destitution, slavery, debtors prisons, and constant warfare again become the norm... and eventually the people will rebel, the world will burn, and out of the ashes a new civilization will rise up, and our grandchildren will enjoy a period of relative peace and prosperity.
Humanity is cyclical.
#fuckbeta #iamslashdot #dicemustdie
In the UK, the right to remain silent has been around since the 17th Century. However, it was removed by the Criminal Justice and Public Order Act 1984.
Since the UK doesn't have a written constitution, it's impossible to argue that a law is unconstitutional. The question cannot be taken to the European Court of Human Rights, because the tight to remain silent is not mentioned in the European Convention on Human Rights, although the majority of E.U. countries have laws giving that right.
Further, the Regulation of Investigatory Powers Act 2000 make it a crime not to disclose an encryption key to police when asked.
Yes, we can choose to not testify in court. However, once you turn up at court to testify, you cannot then refuse to answer some questions.
You're a temporary arrangement of matter sliding towards oblivion in a cold, uncaring universe
England has a right to silence that is very similar to the U.S. fifth amendment.
It wasn't broken, unless you can't think for yourself and need to be told what to think and believe.
The question cannot be taken to the European Court of Human Rights, because the tight to remain silent is not mentioned in the European Convention on Human Rights, although the majority of E.U. countries have laws giving that right.
Actually, it can: the ECHR have ruled that:
"Although not specifically mentioned in Article 6 (art. 6) of the Convention, there can be no doubt that the right to remain silent under police questioning and the privilege against self-incrimination are generally recognised international standards which lie at the heart of the notion of a fair procedure under Article 6 (art. 6) (see the Funke judgment cited above, loc. cit.). By providing the accused with protection against improper compulsion by the authorities these immunities contribute to avoiding miscarriages of justice and to securing the aims of Article 6 (art. 6). "
In other words the European court considers it so fucking obvious it doesn't matter if it's not said. The American consitiution apparently considered it important enough to put down in writing. Sadly our (the UK) government considers it neither important nor obvious.
That ruling was brought against the UK when it was taken to the ECHR for violating the whole "right to silence" thing. Sadly the wankers in power will not get the message.
SJW n. One who posts facts.
This goes directly against prior decisions by the European Court of Human Rights. There is very clear and unambiguous legal precedent, that a person under criminal investigation need not bear witness against himself. For example. in Marttinen v Finland the Court interpreted the article 6.1 that reads inter alia "In the determination of ... any criminal charge against him, everyone is entitled to a fair ... hearing ... by [a] ... tribunal ...". The Court wrote in its decision:
The Court reiterates its case-law on the use of coercion to obtain information: although not specifically mentioned in Article 6 of the Convention, the rights relied on by the applicant, the right to silence and the right not to incriminate oneself, are generally recognised international standards which lie at the heart of the notion of a fair procedure under Article 6
If the defendant is not able to have this sentence overturned in domestic courts, he should hire a lawyer who can bring this case before the European Court of Human Rights ASAP to obtain a decision against the Government of UK. The court will also award compensation for the inhumane treatment of the defendant by the Government, and obligate the government to compensate for the legal expenses.
Reporting on this provision of RIPA is always wrong, and the Slashdot discussion is even worse.
To face conviction for failing to disclose a password in the UK the police have to be able to prove beyond reasonable doubt (and that's specifically stated in the legislation itself) that you knew the password at the time.
This case is no different. The guy was arrested for terror plots, asked to divulge a password but then claimed he didn't know it, the police couldn't prove he did know it so nothing came of it, the guy was jailed anyway under all the other evidence they had.
The police then found it seemed he'd been involved in card fraud. Turns out incriminating evidence of this was on the memory stick and that's why he didn't want the police acting it, because he clearly hoped if he got off with the terrorism charge they'd never find out about the card fraud charge, so he had nothing to lose. Once they had found out about it he hoped for further sentencing leniency over the card fraud for admitting the password and hence helping the police. The problem for him is by admitting it he gave the police the "beyond reasonable doubt" that they needed all along to do him for failing to disclose the password.
So to this day, if you don't know the password, if you pretend you don't know the password, then there's fuck all the police can do to you with this legislation, hence it's not half as bad as people make out.
To date the only people getting done by it are those admitting they know the password and explicitly refusing to hand it over, those who do stupid things like this guy, and for example, more complex scenarios where someone pretends they've lost a password and the police can't cracking, but then they manage to crack, say, weaker encryption such as that used for his desktop login to find his desktop password which they can confirm forensically that he has entered and used since denying knowing his encrypted USB password and if it matches the encrypted USB password they can claim, well, he knew his desktop password, he logged in, and it was the same as his encrypted USB password, and hence beyond reasonable doubt...
Really, it's not the worst law in the world, the police have to hit a pretty high standard of evidence, or the accused has to fuck up and basically admit their own guilt to ever become victim of this. If you genuinely don't know your password, or if you deny knowing it and the police can't prove otherwise, then you're fine. You have to explicitly and provably obstruct a police investigation to get done by this law.
Anyone who commits a crime can be considered a terrorist it's actually a fairly broad term.
I've always said jaywalking was destroying this country.
Proper forensics protocols state that you NEVER work with the original media, only copies.
it doesn't have to be a crime to be terroristic.
"Does this dress make my butt look fat?" strikes terror into any man who's ever heard it! By definition making all women terrorists.
"A person is smart. People are dumb, panicky dangerous animals and you know it." - K
Even those copies are made with a hardware write-blocker - usually a device that sits in the SATA cable or USB connection, blocking any write request packets.
It could be done, but it'd need to be in hardware - a hardened chip that handled the encryption, with the key stored internally and never revealed. Even then a highly skilled attacker might be able to get it out by monitoring power use or some such trick, but it'd be very difficult.
Yes and no. I'm neither a security expert nor an expert in intelligence/counter-intelligence. However, if I were to break a crypto scheme, it is paramount that I never reveal that I have broken the crypto scheme. That way, I can continue to intercept and decode your secrets while you believe that your crypto scheme is safely protecting them.
If AES were broken, the last thing that a government entity would want to do was reveal that it is broken. In fact, if AES has been broken, UK law enforcement officials are extremely unlikely to even be aware of this. It would most likely be an entirely different branch of government (or a different government altogether - e.g. US) who has knows of and has the means to break a scheme like AES.
Don't get me wrong. I agree with your assertion that crypto is good, but this story does not in any way suggest that AES has not been broken yet. I am still suspicious, particularly given that the scheme was "blessed" by the American NSA.
-Turkey
a similar thing can happen in the US. it is called contempt of court.
H. Beatty Chadwick is the record holder for serving 14 years for contempt of court. This was basically for a divorce. apparently they finally released him in 2009.
according to this:
In Chadwick v. Janecka (3d Cir. 2002), a U.S. court of appeals held that H. Beatty Chadwick could be held indefinitely under federal law, for his failure to produce US $ 2.5 mill. as state court ordered in a civil trial.
Yes, we do think those rights should apply outside the US. Mainly because we've thought those were natural (or god-given, depending on preference) rights, not privileges provided by government, since our country's conception.
What's crazy is that I have a handful of encrypted USB sticks and even an entire laptop whose passwords I've long since forgotten. It's not like there's anything on them (That I know of, but a year or so ago I was playing with encryption schemes, full disk encryption, volume encryption, hidden containers, etc for shits and giggles), and recently I booted my laptop to discover that I really have no idea what the password was. Now imagine the stormtroopers come banging on my door tomorrow.. I'm in deep doodoo if they think I'm hiding something on any of those devices. Eventually, I need to wipe/reinstall, but I've not been in any particular hurry...
If you were me, you'd be good lookin'. - six string samurai
From TFS: "already serving time for helping to plot attacks against UK targets"
It is irrelevant to consider a past criminal record. This is a new case, and this case is not regarding terrorist activities but a fraud-related charge. This means that case-law is being created: "even in cases where the charges are only fraud-related, a defendant no longer has the right to remain silent in the UK".
And here, ladies and gentlemen, is why the UK has become a Police State: it started with the slippery slope of "protect the children against porn and terrorism", and now two things have happened:
- You no longer have the right to remain silent;
- Everything you do on the web can and will be censored by the Chinese^H^H^H UK Government;
No way that I am ever going to do business with a British entity. Once upon a time they were a symbol of courage and freedom, today they are the symbol of oppression and prime example for China and North Korea.
I'm not a complete idiot... Some parts are missing.
Since it defines what is and isn't criminal it cannot, by definition, be a criminal organization.
The Constitution defines what is criminal and what is not.
Give me Classic Slashdot or give me death!
The comment was about U.S. citizens who think their constitutional rights DO apply outside the U.S. (they don't), not that those rights SHOULD apply outside the U.S. (this is debatable).
"Really, it's not the worst law in the world": No, it just forces otherwise innocent people to lie.
To face conviction for failing to disclose a password in the UK the police have to be able to prove beyond reasonable doubt (and that's specifically stated in the legislation itself) that you knew the password at the time.
If that were really the case no-one would ever be convicted of this offence. How can you prove beyond a reasonable doubt that someone remembers something? I forget stuff all the time, especially passwords. Even passwords I was using the day before. In fact especially passwords I was using the day before, if they are new.
The problem for him is by admitting it he gave the police the "beyond reasonable doubt" that they needed all along to do him for failing to disclose the password.
He claims he forgot and then later remembered it. That happens sometimes. I don't see how it proves he never forgot it beyond a reasonable doubt.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
Yes, we do think those rights should apply outside the US. Mainly because we've thought those were natural (or god-given, depending on preference) rights, not privileges provided by government, since our country's conception.
Actually not quite. The American Constitution is a contract between american citizens (aka The People) of what you promise not to do to each other. The US Government is not conceived of as an independent entity with its own identity but an emergent property of The People consenting to collect their rights together for the benefit of all The People, based on the pooling of their individual sovereignty. 'We The People' refers to American citizens.
Consequently, since people in other countries didn't sign on to The American Constitution, they haven't made any promises to you of which of your rights they wont violate and you have absolutely no expectation of your contract with your fellow Americans being honoured, also you are not bound by the Constitution to respect the rights of foreigners.
There is however an expectation that anything the American Government has promised to do towards foreign nations it will honour, because The People of 1 nation can freely enter into an agreement with The People of another nation, which is why American Treaties actually form part of the law of the land (and it says this in the Constitution). This, for instance, means the US government must honour the UN Universal Declaration of Human Rights inside the borders of any nation that is a signatory to it because the US is a signatory to it.
The bottom line is that the Constitution is a written contract between The People. The US government doesn't claim to be bound to always respect inalienable rights, but only whatever it expressly agreed to respect.
At the very most some foreign government can violate your so called inalienable rights and you could launch a civil lawsuit (or a revolution) against it for being wronged and a US court might agree with you. But nothing in the Bill of Rights claims that all of the rights contained therein are all inalienable rights.
No one has a right to their *own* opinion. They have a right to the TRUTH.
If it's your wife or girlfriend the proper response is "Shake it!" you have now successfully avoided answering and changed the subject.
Whatever you do, don't break out with some rap "I like big butts and I cannot lie" it's the same as saying yes and it's kind of dorky.
Quick, what is your ATM PIN?
You don't have to actually tell us, but if you're like me, you have trouble remembering it unless you are in front of an ATM.
Just because the defendant was later able to give them the password, does not mean that he was lying when he said he could not remember it at the time.
"I'm not sure I like the fugnutish tone you used in your post!" -RogL (608926)-
Well according to Wikipedia the monarch technically has the power to withhold consent. Just none of them have since 1708.
http://en.wikipedia.org/wiki/King's_Consent
As a non-Brit, I would be interested in hearing an explanation for this.
Unity? Screw that: XFCE. Slashdot Beta? Screw that: SoylentNews. Australis? Screw that: Pale Moon. UX developers DIAF
Umm, no.
The Constitution cannot be amended by act of Congress. It can only be amended by the votes of 3/4 of the individual States.
Congess may PROPOSE Amendments, but the act of proposing such does not guarantee that they'll be enacted.
In addition, a Constitutional Convention may be called by the States to propose Constitutional Amendments. If those Amendments are then ratified by 3/4 of the States, then Congress and the rest of the Federal Government just has to suck it up....
"I do not agree with what you say, but I will defend to the death your right to say it"
I think producing the encryption key probably is incriminating in a lot of circumstances, because it proves you had the ability to access the data, and strong evidence of ownership.
If you already admitted to owning and encrypting the data, then I guess it doesn;t matter. But if your defense is that the usb key isn't yours and you don't know the password, then providing the password does kind of screw up your story.
This is a strange one to get past the american audience, because despite the two legal systems sharing a common root ("common law"), they functionally operate very differently.
So I put to you a scenario. I've just been shopping for some housewares, and happen to have in my shopping bag a l large flat-bladed screwdriver. At the same time, the same object can be found about the person of another chap with a known drug problem and a history of breaking & entering.
Now, under English law, I'm doing absolutely nothing wrong, but it would be quite simple to confiscate the screwdriver from the chap with a history of breaking & entering, enquire about his business this evening, where's he's been, going, and even remand him for a more formal chat if his answers aren't convincing, or he's uncooperative.
In English law, this would be "Going equipped to steal"; the American reaction would be "Screwdrivers are illegal? since when?" Which is where we differ so wildly. It's often said that "possession is nine tenths of the law". In English law, Intent is nine tenths of the law. We really do depend on the judicial system showing some common sense, and protest when it fails to do so.
Which is exactly how this case works. If I encrypt my financial documents, my employer opts to encrypt my harddrive, a journalist encrypts their research, etc, this is prudent, and I would call any overreach against this "abuse of police powers" or "abuse of regulatory powers". But if a convicted terrorist has a cache of encrypted data, yes it's kosher for a court to demand the contents to further their investigation.
I'm quite sure all this makes me sound like an apologist; I believe nothing could be further from the truth. I do value my privacy, I do encrypt things "simply because I can", I'm disgusted by untargeted, dragnet surveillance, etc. But I'm also a realist, and there's a very simple problem here: Outrage at stories like this actually damages my position against such breaches of privacy. Internet Pitchforks are far too readily available, but they make us look like the tinfoil nutters. Where common sense dictates that an investigation is overreach, then yes, yell at the top of your lungs. But to protest a court order made during the investigation of a convicted terrorist - use some common sense.
Except an encrypted hard drive is not a locked shed. It is a notebook, made out of metal, written to with magnets (adjust analogy as needed for flash memory and other alternative storage devices).
And if I'm not required to teach the cops the made-up language I used in this physical paper notebook, why should that change just because the materials that make up the notebook change?
"I'm not sure I like the fugnutish tone you used in your post!" -RogL (608926)-
Prevents, no....but there is nothing that ever prevents such things. The best we can ever hope to do is add hurdles in front of such changes.
Our constitution, for example, what stops congress from declaring it invalid? Nothing really except its own clauses. It is just an agreement. Now that isn't to say they are likely to get away with it. It isn't to say it wouldn't divide the country. In fact, it would do those things...which is the major hurdle to them just "changing their mind".
Likewise, if the Monarch signs a bill put before her which reserves her own power to change it, which puts specific and onerous requirements on parliament in order to change it.... then it is what it is, a new law.
What is to stop them from going back on that and just putting a new bill before the Monarch just like that to nullify it? The same nothing that is stopping congress here: Only the implications of doing so. Implications created by the promises in the document itself.
In the end that is all a constitution is. Its a document which declares the legitimacy of the government and lays out a number of promises to the people about how power will be used; and how these promises can be changed should the need arise. That is all it really is.
They can do that, and with time, those promises will become so ingrained that they will catch appropriate rations of shit should they violate them, and hopefully risk losing their own power.
"I opened my eyes, and everything went dark again"
In 1688 Parliament asserted its power and declared the King to have abdicated and invited William of Orange and his wife the Kings daughter to take the crown. This included a new oath of coronation amongst other things and basically cemented the sovereignty of Parliament. Every sovereign since has been well aware of who actually holds the power since and even in 1708 Anne only declined giving Royal Assent on the advice of her Government. As recently as 1936 Parliament pushed out the King and there is a possibility that Charles could also be pushed out if he gets too political and is still alive when the Queen dies though he'll be old enough they'll probably just wait for him to die.
I'd guess if Parliament tried to pass a really unconstitutional law such as there will no longer be elections and all members of the opposition shall be summarily shot, the Queen would refuse assent so she is sorta the last defence against full out tyranny.
https://en.wikipedia.org/wiki/Inverted_totalitarianism