In UK, Two Convicted of Refusing To Decrypt Data 554
ACKyushu clues us to recent news out of the UK, where two people have been successfully prosecuted for refusing to provide authorities with their encryption keys, resulting in landmark convictions that may have carried jail sentences of up to five years. There is uncertainty in that the names of the people convicted were not released; and without those names, the Crown Prosecution Service said it was unable to track down details of the cases. "Failure to comply with a section 49 notice carries a sentence of up to two years jail plus fines. Failure to comply during a national security investigation carries up to five years jail. ... Of the 15 individuals served, 11 did not comply with the notices. Of the 11, seven were charged and two convicted. Sir Christopher [Rose, the government's Chief Surveillance Commissioner] did not report whether prosecutions failed or are pending against the five charged but not convicted in the period covered by his report."
Self-incrimination becoming mandatory (Score:5, Insightful)
That's rich (Score:5, Insightful)
That's rich. The government convicts people for keeping secrets, and then keeps secrets about who was convicted.
Re:What I want (Score:2, Insightful)
Or just use Plausible deniability, like Rubberhose: http://iq.org/~proff/rubberhose.org/
Re:Self-incrimination becoming mandatory (Score:5, Insightful)
Besides, we all know that the new system is heavily based on proving innocence. Innocent until speculated guilty, and all that.
Not very surprising historically (Score:5, Insightful)
A hundred years ago today, if someone had a giant safe in their house, and they were suspected of any crime whatsoever, the legal authorities (of pretty much every country in the world, it would baffle me to hear about somewhere this would not be the case) would simply ask for the keys. If the person refused to hand them over, the person gets punished. The "punishment" can be of different forms - whether prison in itself, or just a lot more unfavourable treatment from a judge and the assumption of guilt going against you, but nothing at all? Never. The difference with encryption keys is not all that great.
A thought experiment (Score:5, Insightful)
Suppose I have TrueCrypt installed on my machine, but I don't have anything encrypted. What stops to police from accusing me of having encrypted files and demanding a key? How do I prove random bits of data on my HD are random bits of data and not super secret encrypted files?
I doubt I even need Truecrypt installed for the police to use this to get a guaranteed 2 or 5 year conviction.
It's an appalling piece of legislation (Score:5, Insightful)
It's an appalling piece of legislation for a number of reasons:
1. It makes forgetting your decryption key/passphrase/whatever illegal. Yes, seriously. The burden of proof is on the accused to show that they can no longer decrypt the data - how the hell do you prove you don't have something?
2. The people who it was originally intended to inconvenience - the real terrorists, if you like - aren't going to be even remotely concerned by it. They know full well that there is a risk they'll be caught and spend time in jail. If it's a choice between "reveal the decryption key, thus providing the police with the only evidence they're likely to find which implicates you and a number of others for so many criminal activities you'll be in prison for 20 years and when you get out you'll get a bullet in the head for the people who you dropped in it" or "keep your mouth shut, go to prison for two years", I wonder which one they'll chose?
Re:Can I ask.. (Score:3, Insightful)
If it got to the point where you're in court, they will happily pay the £1000 or so that it would cost to read even a cracked CD. And when they found it was blank, they would impose a harsher sentence for lying in the first place.
It's much harder to "destroy" the entire CD that just cracking it. You would almost literally have to set it on fire in order that they couldn't say "well, we recovered 90% of the data from the various shards and found nothing but zeroes".
Re:Self-incrimination becoming mandatory (Score:3, Insightful)
This means, you can be forced to do self-incrimination. What's next? Do we remove the right to remain silent? In dubio contra reo?
This is the UK. They already have removed the right to remain silent [urban75.org] in the Justice and Public Order Act 1994.
I'm I the only one who at first misread the second 9 for an 8?
Re:Self-incrimination becoming mandatory (Score:3, Insightful)
Wait, isn't this more like police demanding you unlock a door? You can't hide evidence behind a physical lock, so why should a digital lock be different?
Re:Can I ask.. (Score:5, Insightful)
What if, what if, what if...
No cute little work-around is going to help, because the RIP act was designed as a tool of authoritarianism.
Recently in historical terms, encryption has became essentially unbreakable [wikipedia.org], and this is the backdoor to it all.
Re:Self-incrimination becoming mandatory (Score:5, Insightful)
Any safe can be broken into, especially if its the police doing it, because no ones going to arrest them half way through the attempt. So key or no key, there getting what they want, though they may have something of a dim view of you come sentancing if you didn't give them the key and whatever illegal activity was in the safe. If there was nothing in said safe, and the key really had been lost, the police more or less wasted there time and your not guilty of anything, after all they never found that key either.
However, with encryption it could well take the span of several peoples life times to crack a key needed to unlock the data, hence the law brought in. However if you have genuinely lost the key, or its destroyed, and you have nothing illegal encrypted, say bank details and the like, your going to prison anyway.
Re:How about if a Policeman... (Score:3, Insightful)
Re:Can I ask.. (Score:5, Insightful)
So? Don't use an empty CD but one with the actual keys. Flip a bit somewhere in the keys.
If they try to decrypt your drive with the key and fail, blame the recovery process.
I think they'd have a pretty hard time proving that the recovery of the keys from the damaged CD was 100% correct. They might get so far as to make it probable, but I know if no way to prove it 100% accurate without the original data to verify it with.
Hmmm, maybe I shouldn't have posted this ... if they find this message and link it to an IP I frequently use ... /me engages in paranoid episode.
Re:Remember this is the UK (Score:3, Insightful)
As an analogy, imagine a shed in your yard that you keep locked. Law enforcement would, under almost all circumstances, require probable cause or a warrant based on probable cause in order to go onto your property and search that shed. However, if they already knew, with little doubt, that there was illegal material in that very shed, then they have the legal justification for a warrant, or a subpoena of whatever information is necessary to open the shed.
It's a funny law in this case, as you can be arrested and convicted for not letting the police into that shed in your back yard even if you have no shed in your back yard. Everyone with a back yard (hard drive) could be convicted to jail without any proof. Convenient.
I'm afraid to travel to the U.K. even with my laptop's harddrive overwritten with /dev/urandom because if they say it's an encrypted drive, how will I prove it's not?
Re:How about if a Policeman... (Score:2, Insightful)
has a warrant and asks you to open the trunk of you car? Do you feel police is forcing you do to self-incrimination? I don't think they're forcing you to say you are guilty of anything, they want to check your property to see if you actually are guilty of anything.
If a policeman has a warrant to open the boot of my car then I will assume that if I don't comply then the policeman will break it open and damage my car in the process. There's no point to resistance in this situation but in the case of an encrypted file they won't be able to break in without your assistance. It's a matter of practicality, not legality.
Re:A thought experiment (Score:5, Insightful)
To clarify, proving that a section of random bits of data on my hard drive is NOT an encrypted file is equivalent to proving that I am NOT a witch.
This could be easily abused by the police. All they have to do is find a section of random data on a hard drive. Then, the police ask you for a key. When you don't provide one ( because there is no key ), you get convicted on "Refusing To Decrypt Data" charges.
It isn't possible to say with certainty what is random data and what is encrypted data.
The logic is obvious (Score:5, Insightful)
The alternative is to lock up everybody who has supplied keys until any legal case is over, so they cannot communicate the news. This would be worse.
Law is simply unable to keep up with the development of mass communications and freely distributable digital data. It's a simple as that. The options are to do a 16th century Japan and ban progress, or accept there will be problems en route.
Re:Not very surprising historically (Score:1, Insightful)
Two points.
It's not necessary to be suspected of a crime. Read section 49 [opsi.gov.uk]. It countenances industrial espionage, for example.
In your example, complaining loudly after the event, in the market square or in a newspaper, would not have been a criminal offence with a maximum sentence of 5 years in prison and a fine. See section 54 (same link).
Re:What I want (Score:3, Insightful)
Random data wouldn't really work as it would get rather 'obvious' as the same file has xyz as contents the first time, abc the second time and pqr the third time you read it.
Overwriting data is stupid too imho, "clearly" they would work on a backup of the data, so when they notice that all data gets overwritten after entering said password, they'll be able to charge you for 'willing obstruction' (or whatever it is called).
Anyway, I'm still confused about this 'right to encryption' so dearly defended by lots of people here.
=> if the authorities have a search-warrant, they are allowed to take pretty much any paper that has something incriminating on it with them. When they ask, you're supposed to open the doors, lockers, safes, etc... so they can get to whatever is behind it. IMHO, same goes for digital encryption. (Sure you could choose not to comply and let them use force to get at it... but if you're 'innocent' I fail to see how that would be beneficial for you !?)
Call me naive, but refusing to give up the keys does make you look guilty any which way you look at it.
Yes I do have locks on my doors too and they indeed come in useful to keep peeping toms out; however when the police knocks saying they suspect my basement to be a meth-lab, well I'll gladly let them in and go look for themselves. Likewise, although I know my neighbour quite well, the moment he refuses police to have a look in his basement for said accusations, my interest will most certainly be piqued and I'm sure the cops' too...
Re:The solution (Score:3, Insightful)
The common population is too stupid and lazy to understand or care about the problem until the ruling class and the media which feed at their trough devote time and airplay telling them that it's important.
No, the real solution is to drop the people that created the problem right in their own mess. These happen to be the same people who could correct the problem. I am of course talking about politicians.
Say, hypothetically, you're a computer tech and you happen to be servicing some MPs computer one day. It'd be an awful shame if you, the unwitting computer tech, were to accidentally stumble upon some very naughty images. Of course, it would be your duty as a citizen to report such criminal activity... only, you've found that after shutting down the computer, you no longer have access to the naughty content. Instead, you identify this large file, several gigabytes in size - which appears to be random junk - but you, as a computer tech, know that it's an EVIL ENCRYPTED PARTITION. The naughty pictures must be in there!
Now that law enforcement have their witch hunt radars powered up, the publicity over this incident will be high. The politician will very quickly learn that he, in fact, can not disprove the claims of the computer tech. Furthermore, he cannot prove that the several gigabyte junk file on his computer isn't an encrypted partition whose keys he is refusing to hand over. Finally, he will come to realise that he will be going to prison because of these reasons.
Just watch how fast the wheels of justice spin when one of the ruling class gets caught in the machine.
Of course, if he's unliked, he'll be thrown under the bus, but at least there'd be a lot of publicity for it. Other politicians will see that the same thing could happen to them, and be more likely to reconsider their stance.
And hey, if he does go to jail, I wouldn't feel too bad. He's probably fucked over hundreds of thousands of people during his career. No such thing as an innocent politician, after all.
Re:Self-incrimination becoming mandatory (Score:5, Insightful)
The police don't know what evidence is there with certainty until they can access it. If they are given the power to break open a physical lock because they have satisfied a judge (or any other requirement) that they are likely to discover evidence by doing so, that's one thing. However, they can get to that evidence with or without your help.
If they believe that decrypting a drive or file will provide evidence and they can get to that evidence without your help fine. If they can only get to the evidence with your help then they have no evidence. And this law is basically saying that with no evidence they can send you to jail.. because you won't help them prosecute you. Which is kind of contrary to the whole concept of legal trials: how can it be mandatory for you to do the work of the prosecution when you are the defendant?
Elsewhere in the discussion others mention the right to remain silent, and when you ask "isn't this more like police demanding you unlock a door? You can't hide evidence behind a physical lock, so why should a digital lock be different?" then there are a whole bunch of slippery slope questions. Isn't this like the police demanding you tell them where you were at the time of the crime? You can't stop them finding out (but they may never unless you tell them). Who were your accessories? You can't prevent forensics from determining that so you should have to tell them!
But really, let's simplify it:
"You can't hide evidence behind a physical lock, so why should a digital lock be different?"
Because it is different? You can hide evidence behind a digital lock, and you do have the right to remain silent. Sometimes. Apparently.
BTW I am from the UK and I grow more ashamed of the people who govern it almost every day.
Re:The logic is obvious (Score:5, Insightful)
Re:The logic is obvious (Score:5, Insightful)
The is so wrong. The logic of the law is that you are now legally liable for your memory. Can't remember something 5 years in prison, it is by far the most offensive legislation there is, hmm, what next death penalty for amnesiacs.
I have forgotten lots of passwords, I have had to rebuild data, redo secure OS installs, drop web accounts, have passwords reset and what some fucked up government and corrupt court decide that they want that information, my total by now 5 years at a time would be up around 250 years in jail. The law is bullshit, there is a profound difference between telling a lie and withholding the truth, conscious effort is required to tell the lie but withholding the truth simply requires a lapse of memory. How many people, failed to get every answer right in every test and exam they have taken, billions of people, it is the norm and in by far the majority of instances, they had been provided all the information required to get 100 percent on those tests and exams.
Now lets start holding politicians to the same standard, zero forgetfulness, zero lapses of memory, zero forgotten promises, 5 years jail for every offences, oh yeah, because it does affect national security.
Re:Not very surprising historically (Score:5, Insightful)
Re:The logic is obvious (Score:3, Insightful)
Now lets start holding politicians to the same standard, zero forgetfulness, zero lapses of memory, zero forgotten promises, 5 years jail for every offences, oh yeah, because it does affect national security.
You could get elected if you went into politics with that agenda, before not implementing it with no consequences! :p
Re:Self-incrimination becoming mandatory (Score:2, Insightful)
Re:Self-incrimination becoming mandatory (Score:4, Insightful)
The right to silence remains. You do not have to answer any questions. The only thing that changed is that they can now say that you did not answer the questions. Prior to the change in the law the police were not allowed to say that you had not answered their questions and that meant that they could not say that they had asked because it is hard to say that something was asked without saying that there was not an answer. This was obviously a stupid situation and was rectified. If you chose not to answer the police can now tell the court that they asked you and you refused to answer, and that can harm your defence (as you are warned).
Re:Self-incrimination becoming mandatory (Score:5, Insightful)
Bear in mind that the State can force Alice to hand over keys in relation to an investigation on Bob, so it's not even a case of prosecuting the guilty, just the forgetful.
Re:Self-incrimination becoming mandatory (Score:3, Insightful)
There is not a death sentence in the UK...
Which is why I specifically stated;
"Since suspects could be hiding evidence of a capitol crime, would that logic then dictate that the only way to make divulging that evidence more likely would be to make the punishment *worse* than the worst normally-legal punishment? Ie; a death sentence where life in prison is the most severe punishment for a capitol crime, or torture THEN death in places where the death sentence is already legal?"
See how I ever-so-cleverly included places that do and places that do not have a death sentence in just such a way as to trick people into believing I didn't mention it at all?
Darned slick if you ask me! :D
Depressingly, it seems Congress has caught on to using this technique also as bills like TARP, the "stimulus", and the health care bills would seem to demonstrate.
Strat
Re:The logic is obvious (Score:3, Insightful)
Erm, from TFA:
There is actually a series problem with animal rights extremists in the UK. Some of them are terrorists in every sense of the word.
Re:How about if a Policeman... (Score:3, Insightful)
When I open the boot (trunk for those in the USA) of the car and the policeman finds a handwritten journal which is in code, does the warrant allow him (or can he get a warrant) to force me to decode the contents of the journal? Forcing you to decode the contents of the journal could (depending on the actual plaintext) be self-incrimination. To my mind, the only difference between paper documents written in code and encrypted files on a computer is the medium on which the documents are stored.
Re:The logic is obvious (Score:5, Insightful)
If you are part of a terrorist cell (or a criminal gang) and the police obtain your encryption keys, telling the rest of your cell or gang will enable them to destroy their own compromised data before PC Plod arrives. That is the logic behind the law.
Umm, that's not logic. That's anti-logic.
Logic would be the realization that a terrorist or organized criminal break laws by definition. Did the people who wrote this honestly think that a terrorist would say "oh, no - our plot to murder thousands of innocent people has been discovered - I'd tell my co-conspirators, but there's that pesky law preventing me!"?!?!
Re:The logic is obvious (Score:5, Insightful)
They can claim that any bunch of random data on your disk is actually hiding something encrypted
This may be technically true, and the poor, random, but arrested sod may get away with the usual blank stares. Anyone using TC, Vsoft, or any of the full disk encryption software on the other hand, will have a hard time convincing me or anybody that the random stuff on your drive is not actually data if the boot loader pops up.
As for me, the wall in my study room also happens to be, ehm, decorated with some certificates for IT courses, photos and old entrance tickets from LAN parties etc. and I have books about technical/programming stuff lying around. How are you EVER going to convince anybody that you don't know how that 'random data' ended up on your hard drive?
Unless full disk encryption is enabled by default in future operating systems, blank stares or denying the obvious are not going to get us out of trouble.
A few points perhaps need making (Score:5, Insightful)
Item 2, terrorism is defined in UK law, and judges have to abide by that law. The definition is not "up to the authorities". It is made by Parliament. If you don't like the definition, write to your MP, join a political party or a pressure group (there are lots) and do something, don't just whine. And if you are a 16 year old posting from your bedroom, William Hague was addressing a Party conference at 16, and I was visiting Parliament several times a year at the same age. You have no excuses. We have senior MPs who get it - David Davis, Chris Huhne.
Item 3.Others have made the point that the UK has had animal rights activists every bit as bonkers and dangerous as US anti-abortion or anti-gun-control activists. But the point also needs to be made that law must be general and not have exceptions. Exceptions make bad law. If we start deciding who is or who is not a terrorist based on anything other than their actions and intentions, this is very dangerous for civil liberties.
Although I think this is an unfortunate law, it is difficult to see how it could be any different. What is your proposal to prevent organised crime using encrypted media to conceal their activities? Unless you can point to a workable alternative solution, you are just ranting.
Re:What I want (Score:3, Insightful)
Call me naive, but refusing to give up the keys does make you look guilty any which way you look at it.
Yes I do have locks on my doors too and they indeed come in useful to keep peeping toms out; however when the police knocks saying they suspect my basement to be a meth-lab, well I'll gladly let them in and go look for themselves
How about when the police knocks on your door asking to see your meth-lab, which is in fact your super-secret fantasy basement, complete with props for you sexual fetishes and evidence of your deviant fantasy of wanting to be your own mother?
The above is not against the law, but you might rather die than have your friends/relatives know about it. Also consider if the basement was the HQ of a (perfectly legal and moral, etc) secret anti-government organisation. While not illegal, I'm sure you would rather the police did not know of its existence.
Re:The logic is obvious (Score:4, Insightful)
A good legal strategy for the guilty (Score:1, Insightful)
Refusing to hand over keys -- max 2 years. Child pron on computer -- average 3 years.
Refusing to hand over keys -- max 5 years. Planning a terrorist act -- average 15 years.
Crypting the hard disk and refusing to hand over the key looks like a good option.
Re:Self-incrimination becoming mandatory (Score:3, Insightful)
It's depressing to think that all of the rights that I enjoy as an American came from the English Common Law and that the citizens of your country are busy surrendering those rights one by one. You've surrendered the right to keep arms, the right to keep silent, the right against self-incrimination, the right of privacy and most of the checks and balances of your Parliamentary system. Am I missing any?
Why do the British people tolerate this? Your history suggests that you should know better. What's it going to going to take before you wake up and vote the scumbags out of the Commons and/or rise up against them?
Re:The logic is obvious (Score:4, Insightful)
its the vile bullshit he was spewing that the authorities objected to
If the authorities get to decide that what you are saying is "vile bullshit" and punish you for saying it then free speech is worthless and we might as well abandon it.
Re:The logic is obvious (Score:3, Insightful)
I don't think the authorities involved are that stupid. You can be sure they deduced from the suspect that they do remember the keys, and that they hide significant information relevant to the prosecution. It's not 1984 everytime someone has to give up information to the police.
Re:The logic is obvious (Score:3, Insightful)
Yes, well, it's all about the animals isn't it? I mean, really, if I were to bomb things, burn things down, physically intimidate and threaten people, indoctrinate other people into a cult-like society of violence and terror, but it was for the animals, certainly I could not be called a terrorist, could I?
RTFL (read the fscking law) (Score:5, Insightful)
Item 2, terrorism is defined in UK law, and judges have to abide by that law. The definition is not "up to the authorities". It is made by Parliament.
Instead of pontificating, why don't you just actually read the law [opsi.gov.uk]. There is a disclosure requirement if:
Those provisions are so vague that police can require you to disclose encryption keys for anything at any time.
What is your proposal to prevent organised crime using encrypted media to conceal their activities? Unless you can point to a workable alternative solution, you are just ranting.
The purpose of this law is not to prevent covert communications because that is impossible in principle.
The purpose of this law it's to give the UK government additional means to force people to obey the government even in areas where the government otherwise has no cause or legal means of forcing you. It's a totalitarian law forced through parliament under the pretext of crime and terrorism prevention.
Re:The logic is obvious (Score:5, Insightful)
The lesson here is that just like with child pornography, governments start out using unpopular groups to introduce new repressive methods. If we don't speak up in their defense now, even if we don't care about the groups being targeted, we'll almost assuredly be next ourselves.
Re:ritual umbrage (Score:4, Insightful)
To be more precise, *every* large random block of information, when XORed with a specific key, is child porn, or nuke designs, or the text of the Bible. It's an equation with two unknown variables. Not only is it impossible to prove that the data isn't illegal, it is possible to prove that any string of data *is* illegal. You just have to choose your key.
The Bible is a string of random data that when correctly XORed, provides complete plans to make nerve gas, just the same as every other chunk of data.
Re:The logic is obvious (Score:3, Insightful)
But why punish more people then? So if you didn't happen to get bombed by an extremist, you also get an opportunity to be arrested for having encryption too?
I'm not sure how it is a net positive for people. Is it better to catch a criminal and send 5 other people to jail or to have all 6 of them out of jail?