Slashdot Mirror
UK Computing Student Jailed After Failing To Hand Over Crypto Keys
stephendavion sends news that Christopher Wilson, a 22-year-old computer science student, has been sent to jail for six months for refusing to hand over his computer encryption passwords. Wilson has been accused of "phoning in a fake warning of an impending cyber attack against Northumbria Police that was convincing enough for the force to temporarily suspend its site as a precaution once a small attack started." He's also accused of trolling on Facebook.
Wilson only came to the attention of police in October 2012 after he allegedly emailed warnings about an online threat against one of the staff at Newcastle University. ... The threatening emails came from computer servers linked to Wilson. Police obtained a warrant on this basis and raided his home in Washington, where they seized various items of computer equipment. ... Investigators wanted to examine his encrypted computer but the passwords supplied by Wilson turned out to be incorrect. None of the 50 passwords he provided worked. Frustration with his lack of co-operation prompted police to obtained a order from a judge compelling him to turn over the correct passphrase last year. A judge ordered him to turn over these passwords on the grounds of national security but Wilson still failed to comply, earning him six months behind bars.
Everything about this is a fiasco.
Encryption is not a crime. Hiding evidence of your crimes using encryption probably is. Being so stupid that you have to rely on that encryption to keep your ass out of jail definitely should be.
"He's also accused of trolling on Facebook."
If that doesn't spell out terrorist, I don't know what does.
* draws a a giant black X over England *
Would have been nice to see Stonehenge, the castles, some Shakespeare... Ho, hum.
Maybe if enough of our younger generation see how unjust these laws are, they will vote and get the crooks out of office.
The passwords worked, they were just case sensitive and the police didn't realize they had Caps Lock on.
I'm not saying this is likely, but what if he forgot the passphrase? This was two years ago after all.
Who's to say if he has actually forgotten it or just doesn't want to supply it?
(Haven't read the article of course, so maybe they covered this...)
I wish the penalties for trolling legislation would be at least half as severe ...
I'll never visit that police state. I recommend no one else does. I may be spied on in the US, but at least I'm not charged with the crime of "trolling facebook".
God damn, you eurotrash need to stop this shit before it spreads to the US.
So now threatening to deface a police website is a matter of national security. Got it.
We don't have a state-run media we have a media-run state.
They won't, young people are mostly dis-enfranchised and don't vote. I'm not exactly young and I don't vote because it changes nothing (my vote under the system here is worth about 0.013 of a vote).
What if he did give them the right one, and they just typed it in wrong?
What if the government is lying? They can now jail you without any proof.
I do not remember the password.
Proof of contempt
Although the court’s power to punish through contempt is broad, contempt is meant to be exercised rarely and is presumed not to exist.
A person may not, for example, be jailed for failing to turn over property not in his possession. But for this exception to apply, the inability to comply must be involuntary. If a person puts himself in a position where he is unable to comply with the order, then he may still be held in contempt.
If I do not remember the password, it is no longer in my possession.
Ok, this is the UK and everything is admissible. So he's done unless there some EU Right (unlikely).
But in the US -- mass lawless (warrentless) behaviour of the NSA & other govt agencies is such that any evidence from them should be considered "fruit of the poisoned vine". The agents willfully behave this way, apparently believing that prevention is more important the punishment (or that they can parallel (perjury) construct a conviction.
They want it this way, so why not formalize it?
"He even suggested sending nasty messages on a condolence page set up for two female police officers shot dead in Manchester" this here will get you fucked up by the law. All the other stuff is just throwing whatever might stick at him in my opinion.
"Kill 'em all and let Root sort 'em out"
Comment removed based on user account deletion
Take a page from the politicians' playbook.
Seems to me if you want to stick to the strict letter of the law, just hand over your crypto key... so the police can decrypt your file... which is itself still encrypted with something else.
Sorry, you asked for Key A, that's what you got, now you want another one? Call a lawyer and start again!
Mostly random stuff.
It's called a dead man's switch. You can set up something to delete your data if you don't log in every so often.
If the authorities have a proper search warrant, I don't see why he can't be compelled to give his encryption keys. It is no different than being compelled to provide the key to a locked desk. The location of the key is irrelevant, whether it be in his mind or on his keychain.
None of the 50 passwords he provided worked
I really want to meet the cop who said, after failure 35: "Hey come on guys let's ask one more time!"
This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
Starting with this shit judge.
Gag orders and such have already been flaunted; the law comes up with bullshit to try and force childish "you can't do that!" rules and other simpleminded "solutions" that seemingly box things in. Then people circumvent it with deadman canaries that they can't be accused as "responsible" for.
My immediate reaction was a 24-48h deadman that locks up and send the decrypt to someone random on a list. The list includes sythetic names. By nature the message obviously signifies duress (or death) and the messenger will make an appropriate approach.
"I can't decrypt it. That's not a figurative claim; I literally do not have the capability to decrypt it, and I don't know who does."
I'm sure people more clever than I could imagine solutions better than my proof-of-concept.
I believe cron job technology might be able to pull this off.
Eventually the disenfranchised (it's not hyphenated, btw) youth will be the older generation(s) and the ones who go all crazy voting these days will not be around anymore.
For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
"He's also accused of trolling on Facebook."
It has begun.
I would love for gmail to give people the option of a random noise uuencoded .sig to be attached to each and every e-mail. Flood the world with random data and this issue goes away. No one would be able to say for sure what was encrypted or not. If done ubiquitously, it could bring all the STASI-like agencies to their knees.
That's why the pull the drives out of the system and put them in their own system. A better solution would to be have two keys one to decrypt the other to install malware/viruses and destroy all data on the system the drive is attached to.
That would only work for a secure system. That is, one that is still running at your home and not powered down in a police evidence locker. Once they grab it, they can copy the data off without giving two bits what your dead-man switch thinks it's going to do at the top of the hour.
Once the data is in their hands, you have lost the ability to destroy it.
The computing student should learn to use hidden partitions:
http://www.howtogeek.com/10921...
After that, he can just fill the normal encrypted partition with porn, give the police password for that and just tell them he was embarassed to download so many xxx films.
3 things to take into consideration.
1) The first thing that happens when your equipment is seized is that they do a 1:1 copy of the content of your hard drives.
2) A dead man's switch would only work if it still had power and you were storing all the content somewhere else, will not help you in the case of your pc drives hosting the content in question.
3) You could easily have an encryption system that scrubs the drive with the right "wrong" password or after a couple failed attempts, which brings you back to point 1, they just reload their image and try again.
"Look, I can't give you a password even if I wanted to, because that's not encrypted terrorism on that drive. It's just static. I use it for randomizing things."
How inappropriate to call this planet Earth, when clearly it is Ocean.
He probably has evil porn on there - the kind that would get him a few decades in prison.
Did the police try the "Forgot my password..." link under the password field? That works for me when my users don't have their password :-).
So you do not believe in Elon figuring out the cure for ageing soon, then?
How inappropriate to call this planet Earth, when clearly it is Ocean.
Good! The sooner that Republican cesspool is destroyed, the better. It is such an effective tool for their kind to use to continue their oppression.
... as usual. Our jewish 'masters' are telling us what we can and can't say, and what we can and can't THINK.
"Tyrant judge"?! He was applying the law. A bad law in the opinion of many people, sure, but nonetheless crystal clear in its scope and effect. Are you saying the judge should have not applied the law? That he should have ignored the statute and made up his own rules? You're in favor of "activist judges"?
My next sig will be ready soon, but subscribers can beat the rush
...this isn't just limited to encryption keys.
They can jail you for failing to hand over a password for authentication.
So failing to hand over a password (when asked) that logs you into say, slashdot? Jail for you!
The UK is truly a fascist country.
Police: "Give us your password."
Me: "No."
*jail for six month*
Police: "Give us your password."
Me: "No."
*repeat*
Just keep doing it. I'm sure after about 20 years they'd clue in to the fact I have no intention of coughing up the password.
Besides, I'd be quite happy to waste as much taxpayers money as possible doing so.
Over time I have used a lot of passwords at a lot of different sites as well as on storage devices. There is no way i could ever recall many of them. A judge might as well order me to walk on water and raise the dead. This type of thing tells me that the judge has not have a lot of time on computers or he has a memory that is long term, photographic in nature.
In short, in terms of cryptographic schemes, time expiry doesn't work. You can always control its execution environment (see VMs). A proper dead man's switch would be physically implemented, likely with multiple triggers (perimeter alarm, building exterior breach, power failure, interior motion sensors, case alarm, accelerometer...), would not rely on having a power source to actuate (you might have a powered mechanism and a mechanical failsafe for power interruption). For instance: magnetic latches holding a spring loaded striker over a vial of acid which cracks and dissolves the chip with your key. Thermite might work too, but you'd have serious safety issues with that system.
The maximum time for key entry to disable it should take into account the length of time you can stand being beaten with a pipe wrench and the length of time needed for the mechanism to act vs the amount of time it would take to disassemble the system and prevent disruption of key material. Also, these systems only work for things that you'd rather lose than have become public.
Alternatively TrueCrypt's plausible deniability works well.
I tend to start twitching a little whenever our neighborhood geek starts talking long and loudly about his "plausible deniability."
The denial is there, in spades. I'll give him that.
The plausible, not so much.
Or a physical layer of security that damages the drive in the event of a jostle/power-down/whatever.
An idea: to defend against this forced self-incrimination, prepare ahead of time -- encrypt your data using strong methods such as Blowfish or AES, then generate an XOR one-time pad of the ciphertext which, when combined with it, renders something innocent like the text to your Harry Potter fanfiction-in-progress. You can provide them the XOR key, they get some plaintext that obviously makes sense, and you have plausible deniability.
What if the passphrase was something like "I hid the murder weapon under the floorboards in the kitchen"? So that the phrase itself was incriminating? Can you be compelled to reveal such a phrase, or if you did would the prosecution be prohibited from using it?
So 6 months (he'll probably end up doing about 2 if that) of free food, free board, free Sky TV for the pleasure of sticking it too the man.
Well done sir !
It won't work. Police forensics technique is simple. They take 2 or 3 copies of the data. The extra copies are stored as evidence of the original data. The in use copy is then plugged into a device that denies writes, preventing the data being overwritten.
http://www.youtube.com/watch?v=NA9B6-s6r7Y
You just said that being stupid should be a crime. So what is the IQ cutoff where you consider that people should not be breaking the law by merely existing?
He trolled on Facebook!??! Say it isn't so!