UK Computing Student Jailed After Failing To Hand Over Crypto Keys 353
stephendavion sends news that Christopher Wilson, a 22-year-old computer science student, has been sent to jail for six months for refusing to hand over his computer encryption passwords. Wilson has been accused of "phoning in a fake warning of an impending cyber attack against Northumbria Police that was convincing enough for the force to temporarily suspend its site as a precaution once a small attack started." He's also accused of trolling on Facebook.
Wilson only came to the attention of police in October 2012 after he allegedly emailed warnings about an online threat against one of the staff at Newcastle University. ... The threatening emails came from computer servers linked to Wilson. Police obtained a warrant on this basis and raided his home in Washington, where they seized various items of computer equipment. ... Investigators wanted to examine his encrypted computer but the passwords supplied by Wilson turned out to be incorrect. None of the 50 passwords he provided worked. Frustration with his lack of co-operation prompted police to obtained a order from a judge compelling him to turn over the correct passphrase last year. A judge ordered him to turn over these passwords on the grounds of national security but Wilson still failed to comply, earning him six months behind bars.
But it wasn't for "national security" (Score:5, Insightful)
Everything about this is a fiasco.
Re:But it wasn't for "national security" (Score:5, Insightful)
Fuck the UK.
Re:But it wasn't for "national security" (Score:5, Interesting)
in any way incriminating yourself?
This. Exactly this. When any law enforcement agency suspect that I am guilty of a crime, I have the right to remain silent. With these "tiny little" exceptions, governments are getting onto a slippery slope. Right now it's just passwords. The next step will be the location of harddrives with evidence. Then it will be "tell us where the body is so we can convict you, if you don't tell us you'll go to jail anyway".
In my opinion, the right to remain silent is absolute. No matter how you look at it, this man is being jailed for remaining silent in a criminal investigation. And that, my friend, are Soviet practices.
Not being able to prosecute certain crimes for lack of evidence is the cost that a society pays for having a level playing field and a fair trial.
Re:But it wasn't for "national security" (Score:4, Informative)
You do know the US has "Stop and Identify [wikipedia.org]" laws which require you to talk to police? For example, in Texas :
"A person commits an offense if he intentionally refuses to give his name, residence address, or date of birth to a peace officer who has lawfully arrested the person and requested the information."
It's a class C misdemeanor.
These laws have been challenged [wikipedia.org], and SCOTUS ruled that they don't violate miranda rights.
Re:But it wasn't for "national security" (Score:4, Insightful)
You do know the US has "Stop and Identify [wikipedia.org]" laws which require you to talk to police? For example, in Texas :
"A person commits an offense if he intentionally refuses to give his name, residence address, or date of birth to a peace officer who has lawfully arrested the person and requested the information."
It's a class C misdemeanor.
These laws have been challenged [wikipedia.org], and SCOTUS ruled that they don't violate miranda rights.
Yes, and..? The United States hasn't been a free country for a long long time now.
Re: (Score:3)
Re:But it wasn't for "national security" (Score:4, Interesting)
Except in the UK, you do not have the right to remain silent, or at least, you can remain silent but that may work against you in court.
Wikipedia explains,
"The right to silence was amended in 1984 by allowing adverse inferences to be drawn at a court hearing in cases where a suspect refuses to explain something, and then later produces an explanation. In other words the jury is entitled to infer that the accused fabricated the explanation at a later date, as he refused to provide the explanation during police questioning."
Furthermore, this is nothing new to the UK; there is precedent [hotair.com] for being arrested for not providing your password to the police when requested, and the courts supported the action.
Re: (Score:3)
In my opinion, the right to remain silent is absolute.
It is absolute, in that it absolutely doesn't exist. There is no "right to remain silent" in the literal sense. The Fifth Amendment to the US Constitution specifies that no one "shall be compelled in any criminal case to be a witness against himself." Nowhere is there the explicit or implicit Constitutional right to not speak under all circumstances. The difference between not speaking and not being a witness against one's self is not a semantic technicality. For example, if given immunity from prosecu
Re: (Score:3)
Since when is a password in itself evidence, or in any way incriminating yourself? What the police find from access granted by said password is another matter.
It would be incriminating in rare cases. For example, if the police don't know for sure that it is _your_ computer involved in a crime, then providing a password would prove that it's your computer, and it would be incriminating. That's why for this law to apply in the UK, the police must already have evidence that you have the password.
Re: (Score:3)
Terror (Score:5, Funny)
"He's also accused of trolling on Facebook."
If that doesn't spell out terrorist, I don't know what does.
Re:Terror (Score:4, Funny)
"He's also accused of trolling on Facebook."
If that doesn't spell out terrorist, I don't know what does.
I don't know about that. I could only spell "terois" with those letters.
Re: (Score:2)
Plot Twist... (Score:4, Funny)
The passwords worked, they were just case sensitive and the police didn't realize they had Caps Lock on.
What if he forgot it? (Score:3)
I'm not saying this is likely, but what if he forgot the passphrase? This was two years ago after all.
Who's to say if he has actually forgotten it or just doesn't want to supply it?
(Haven't read the article of course, so maybe they covered this...)
Re:What if he forgot it? (Score:5, Informative)
Re: (Score:3)
Some of us have girlfriends/partners/spouses, and we occasionally drive each others' vehicles for reasons of convenience, pleasure, etc.
Back in the 90s my then-g/f and I used to regularly swap cars (all above board with insurance etc.) depending on where we were going, what we were gonna be carrying, even which car had most fuel in it, etc. etc.
In fact more recently I did the same thing for about a year or so when I lived with a woman for a while who had kids - her car had child seats in it, mine didn't. R
Re:What if he forgot it? (Score:4, Informative)
Re: (Score:2)
The presumption is that where you valued the information enough to lock it in a safe and not write down the password, that you have a good enough memory that you anticipated being able to remember it. Where you didn't presume to remember it, you would write it down somewhere, or provide for some other means to access it.
It isn't foolproof, you could eventually forget; but you could also "remember" after a few weeks in the can, too. Outside of brain damage or illness, you don't "forget" very much; even thing
Re: (Score:2)
Re: (Score:2)
and then we can forget about your release date
Re: (Score:3)
Alas, a good sphincter clenching life event such as, for example, being aggressively interrogated, tossed into the clink, and then threatened with years of incarceration is a good recipe for forgetting things.
People make up passwords they're sure they'll remember and then can't remember them the next day all the time.
Quick, what did you have for breakfast on May 23rd 1998?
Re: (Score:2)
That would be my first assumption. Or what if you were using a key file, that you no longer have? I never really used PGP much, but I must have set it up a dozen times, with a different random password each time. And I certainly couldn't tell you what those passwords are now. It's barbaric to convict someone on this basis.
Re:What if he forgot it? (Score:4, Interesting)
Spock: "A lie?"
Valeris: "A choice."
Re: (Score:2)
trolling on Facebook (Score:3)
I wish the penalties for trolling legislation would be at least half as severe ...
National security (Score:3)
So now threatening to deface a police website is a matter of national security. Got it.
Re:National security (Score:5, Informative)
Re: (Score:2)
And that bullshit about powering on electronics if you're flying to the States? That just got broadened to *all* flights *anywhere*. I knew it was coming, I just didn't expect it within 3 fucking days...
Compelled NatSec evidence IN-ADMISSIBLE ? (Score:2)
Ok, this is the UK and everything is admissible. So he's done unless there some EU Right (unlikely).
But in the US -- mass lawless (warrentless) behaviour of the NSA & other govt agencies is such that any evidence from them should be considered "fruit of the poisoned vine". The agents willfully behave this way, apparently believing that prevention is more important the punishment (or that they can parallel (perjury) construct a conviction.
They want it this way, so why not formalize it?
ANYwhere in the world (Score:2)
"He even suggested sending nasty messages on a condolence page set up for two female police officers shot dead in Manchester" this here will get you fucked up by the law. All the other stuff is just throwing whatever might stick at him in my opinion.
So, double encrypt (Score:2)
Seems to me if you want to stick to the strict letter of the law, just hand over your crypto key... so the police can decrypt your file... which is itself still encrypted with something else.
Sorry, you asked for Key A, that's what you got, now you want another one? Call a lawyer and start again!
Hope springs eternal... (Score:4, Funny)
None of the 50 passwords he provided worked
I really want to meet the cop who said, after failure 35: "Hey come on guys let's ask one more time!"
The Internet Needs More Random Data (Score:3)
I would love for gmail to give people the option of a random noise uuencoded .sig to be attached to each and every e-mail. Flood the world with random data and this issue goes away. No one would be able to say for sure what was encrypted or not. If done ubiquitously, it could bring all the STASI-like agencies to their knees.
Re: (Score:3, Insightful)
Data stored digitally on your computer is the equivalent of your own memory.
Encrypting it keeps others out of it.
5th amendment protects against self-incrimination, period.
This trumped up charge needs to be dropped.
The judge needs to be de-benched and sent to prison for being a constitutional terrorist.
The prisoner should sue the City, the district attorney's office and the judge for everything they have for wrongful imprisonment, falsifying charges, and basic ass-hattery.
Re:Seems appropriate (Score:5, Informative)
There is no "5th Amendment" in the UK.
Re:Seems appropriate (Score:5, Insightful)
Seems the founders of computing as we know it have lost their way.
Re:Seems appropriate (Score:5, Insightful)
That's why you need two factor authentication. A password and a keyfile stored on floppy disk. Ideally an old floppy disk with multiple read errors. If you are arrested you can say that the police must have damaged the disk.
Alternatively TrueCrypt's plausible deniability works well.
Re: (Score:3, Informative)
That will not work - UK law expects you to keep safe copies of all your keys and passwords so that you can provide them when asked to do so - you go to jail for not being able to provide them, saying you forgot them does not get you out of jail.
"Right. Prepare the waterboard!" (Score:2)
"Look, I can't give you a password even if I wanted to, because that's not encrypted terrorism on that drive. It's just static. I use it for randomizing things."
Re: (Score:3, Interesting)
Tell it to the judge. (Score:3)
Alternatively TrueCrypt's plausible deniability works well.
I tend to start twitching a little whenever our neighborhood geek starts talking long and loudly about his "plausible deniability."
The denial is there, in spades. I'll give him that.
The plausible, not so much.
Re:Seems appropriate (Score:5, Insightful)
As bad as the US is getting, I sure AM glad I don't live in the UK with THIS crap going on...
Re:Seems appropriate (Score:5, Insightful)
To be fair, in the US they'd have just charged you with a bunch of more serious crimes as well, which they'd offer to drop if you plead guilty for the one they wanted you for.
Re: (Score:3)
Probably wire fraud, resisting arrest and impeding a police officer's fist with your face.
Comment removed (Score:5, Insightful)
Re:Seems appropriate (Score:4, Informative)
And in the US, you can be similarly compelled in some circumstances.
https://www.youtube.com/watch?... [youtube.com] - interesting presentation by the EFF on forced disclosure laws.
The 5th amendment does _NOT_ always apply.
Re: (Score:3)
The poor guy probably had the password written down on a Post-it note underneath the keyboard because it was too long and complicated to reasonably remember. The police in their hurry, when they confiscated the computer, lost that little note. How can anyone prove that this was not so. How can anyone prove that the guy does indeed not remember the password? After all, humans are forgetful creatures. I suppose being forgetful can land you in jail in the UK.
Re: (Score:3)
Yes, you turn over they keys to the safe and inside they find sheets of paper with what appears to be random letters and numbers written on them. Can the court compel you to disclose the "meaning" of what is written on those documents?
Re: (Score:3)
Because a court ordered him to, and he didn't. The fact that encryption keys are the subject of the order or whether they unlock anything incriminating is pretty much irrelevant under the circumstances, disobey any court order and you face going to jail.
Re: (Score:2)
Which is one of the reasons the founding fathers started a new country. With the right to due process. And blackjack. And hookers.
In fact, forget the blackjack and hookers. Ahh, screw the whole thing.
Re:Seems appropriate (Score:5, Informative)
It seems you can be compelled to reveal your passwords in the US [arstechnica.com] if they're looking for evidence they already know to exist rather than information they may not know about.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
The prisoner should sue the City, the district attorney's office and the judge for everything they have for wrongful imprisonment, falsifying charges, and basic ass-hattery.
They have nothing. You can only take money from your community.
Re: (Score:2)
Re:Seems appropriate (Score:5, Interesting)
People have argued the right to not incriminate themselves right up to the European courts, but it was rejected. When you are arrested in the UK you are told that if you fail to mention when questioned anything you later rely on in court it may harm your defence, so there is no right to silence either.
What isn't clear from the story is if this guy just forgot his password or if he refused to hand it over. The law says that the police must prove you knew the password, e.g. by showing that you used it very recently.
Either way, it's a fucked up law that needs to be repealed.
Re: (Score:2, Informative)
When you are arrested in the UK you are told that if you fail to mention when questioned anything you later rely on in court it may harm your defence, so there is no right to silence either.
That isn't a right to silence. You're quite free to keep your mouth shut from arrest to the end of the trial. The only worrying part is that maintaining silence can be taken as an indication of guilt*. Talking about something in court which was not mentioned during police questioning may harm one's defence because anyone in the court is likely to think "if that would have helped, why didn't you say when you first had the chance?".
*This might be another one of those things that is only in English or Scots l
Re: (Score:3)
Re: (Score:2)
This is UK, queen and all. I don't think 5th amendment applies there.
Re:Seems appropriate (Score:4, Interesting)
One of them is it only applies in the United States, not in the United Kingdom. duh.
Another is that if you agree to give up your right (i.e. offer a password), then you can be punished for lying about it (i.e. offering a false password).
Re:Seems appropriate (Score:5, Insightful)
Wrong, wrong, wrong, and wrong.
Leaving aside that this is UK news and the UK doesn't have the 5th Amendment, protection from being forced to testify against yourself is not based on this ideology you assume it is where your memory would be protected. You misunderstand the entire reason for the right. The reason for the right is because of the long history of forced confessions. History teaches that when the police interrogate them long enough and hard enough they can get them to "confess" to almost anything; even heinous crimes carrying the death penalty. This can be achieved without traditional torture, with just hard questioning and lack of sleep. Because of the physical power the police hold over a person who has been arrested, this is a pervasive problem in places without these protections, including historical England.
But the 5th Amendment doesn't protect physical facts, and it doesn't protect your memory; it protects you from testifying about your memory. If your memory could be read by doctors using a harmless mind-reading machine, that would be allowed, because it would be physical evidence, not testimony that might have been compelled.
Another problem with compelled testimony is where they attempt to accuse a person of lying in their claim of innocence, even before it is established that they are guilty. Prosecutors are very good at that; finding some innocent detail you remember wrong, or perceived differently than witnesses, and then using that to "prove" you're lying. And your denial contains lies, that is almost the same as a confession in the hands of a skilled prosecutor.
Another example of what can be compelled is the location of a key to safe, or the combination to a safe; assuming the police have a warrant, no physical evidence is protected by the 5th Amendment, including things like the location of a key. The safe is physical evidence, not testimony. And the location of the key is an objective physical fact that is not prone to the type of abuse that a compelled confession is.
And you would send a judge to freakin' prison over your lack of understanding of the very rights you claim to value, yet somehow know nothing about. You even then somehow manage to work in a false accusation of terrorism. There is nothing basic about your ass-hattery; you're a first class champion ass-hat!
Re:Seems appropriate (Score:5, Insightful)
The problem with demanding the key and jailing him for not doing so is that they haven't (as far as I know) proven he actually remembers the key at all. Have they done anything to prove that he didn't genuinely believe the passwords he told them would decrypt the data? People do forget things all the time, even very important things. Throw in some duress and mental anguish over being jailed plus autism and it's a wonder if he gets his middle name right.
The fundamental problem with any penalty for not testifying is that it hinges on punishing someone for a crime you can never actually prove them guilty of. That might actually be good reason to punish a judge, or at least remove them from the bench. Not being punished unless proven guilty is a fundamental right that goes well beyong the Constitution or any particular foundational document.
Re: (Score:2)
I'd say the 4th and 5th amendments would say they could not search your memory. At least in the US. And if you're not a Muslim.
Re: (Score:2)
If your memory could be read by doctors using a harmless mind-reading machine, that would be allowed, because it would be physical evidence, not testimony that might have been compelled.
Actually, given the fallibility of human memory, I don't see how you could convert imperfect memories into anything better than a "machine-forced testimony". You just can't beat entropy by using a magical machine.
Re:Seems appropriate (Score:4, Insightful)
If your memory could be read by doctors using a harmless mind-reading machine, that would be allowed, because it would be physical evidence, not testimony that might have been compelled.
Typical lawyer doublespeak bullshit.
same asshattery that gives
Re: (Score:3)
Funny isn't it - the US doesn't allow compelled testimony, but resolves 97% of federal cases through plea-bargain, so that's >97% conviction rate.
I'm sure plea bargains are always always guilty people accepting a lesser charge to reduce their punishment, and never the innocent feeling compelled threatened or coerced into pleading guilty to a lesser charge, but in the UK where it's not used I think the prosecutors only get about 80% convictions - and you'd think they would be much _more_ careful to pick t
Re: (Score:3)
and never the innocent feeling compelled threatened or coerced into pleading guilty to a lesser charge, b
You know what? If an innocent person pleads guilty before a judge, they are perjuring themselves.
That's what "No Contest" pleas are for.
Re: (Score:2)
And since when does the US 5th Amendment apply to anything in Northumbria?
Re: (Score:2, Funny)
Reactionary? What are you, a shill for tyranny?
Re: (Score:3)
Reactionary? What are you, a shill for tyranny?
An independent judiciary is a keystone of a free society. So, yes, jailing judges for their rulings is quite reactionary.
Re: (Score:2)
So what would you do with tyrant judges like this one?
I would allow the defendant to appeal the ruling. I would also allow the legislature to impeach judges that engaged in misconduct.
Would you prosecute the judge if he murdered someone?
Yes. He should be prosecuted. I think we can all agree that judges shouldn't be allowed to murder people with impunity.
Is "tyrant" now the opposite of "activist"? (Score:4, Insightful)
Re:Is "tyrant" now the opposite of "activist"? (Score:5, Informative)
"Tyrant judge"?! He was applying the law. A bad law in the opinion of many people, sure, but nonetheless crystal clear in its scope and effect. Are you saying the judge should have not applied the law? That he should have ignored the statute and made up his own rules? You're in favor of "activist judges"?
A judge should be free to question a law, yes.
Judges in Australia have come out of court saying the law was wrong. I believe Judges in the US are allowed to do the same if it contravenes your constitution (same here, we have a constitution too you know).
A judiciary that blindly follows the letter of the law is pointless as they just become to tools of politicians who often write bad and lopsided laws (hence making an independent judiciary pointedness). Nice try to poison the well with that "activist judge" quip, but it didn't work.
Re: (Score:2)
Well, it is a monarchy there...
Re:Seems appropriate (Score:5, Informative)
Re:Seems appropriate (Score:4, Insightful)
Re: (Score:2)
that's a fiction, you are no more interpreting your files than the police are. it's encrypted and decrypted by an algorithm that requires a specific key... the person interpreting for you and for them was whoever designed the software. if you want to use the "interpreting" argument, you'd have to write your own encryption software.
Re: (Score:2)
Re: (Score:3)
That is a totally different issue, because if they plant evidence on your computer, they don't need encryption for that. And if they're going to "go there" they can just plant some drugs on you if for some reason they don't have the technical skill to get it onto your computer, or if you have encryption.
Re:Seems appropriate (Score:5, Insightful)
[boot up in single user mode so syslog and ntpd are not running]
# date 0417212012
# su - victim
$
[pigs copy incriminating files at will using cp without -p]
[could change the date numerous times for different files]
Yeah, that's REAL hard. They just planted files with an mtime, ctime, and atime of 2012.
How can timestamps be "out of sync with the rest of the system"? Every file in the system has different timestamps as it is.
Re: (Score:3)
Actually, every file in the system does not have different time stamps and they tend to be in clusters (e.g., different groups of system files).
Timestamps can be manipulated in various ways and they are often taken at face value, but it does get quite a bit harder if the investigator digs deeper. For example, in your proposed situation the inodes for the newly created files would not be as expected for files having those time stamps.
Re: (Score:2)
It isn't at all difficult to fake a timestamp on a typical filesystem. There are standard system utilities that will let any user do that to any file he has write permissions for.
Re: (Score:3, Insightful)
Re: (Score:2)
Re: (Score:2)
Forgetting is not a legitimate defence, much like torturers say, you would say that wouldn't you?
So basically marriage is a good preparation for criminal defense.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Why do you think the Constitution of the United Stated of America's first amendment is... the first amendment?
Because this behavior from the UK is hardly new...
Re:Stay away from the UK (Score:5, Insightful)
Yeah, I always wanted to do a UK trip, but their crazy laws have always kept me away. Not even because I'm worried that I'll get caught up in them, so much as I look down on them as a people for institutiting them in the first place.
And no, the irony isn't lost on me that many do not want to visit America for the same reasons. I probably wouldn't either, if I weren't a native.
Re: (Score:2)
I understand because we're in the same situation in the US. People have had plenty of time to wake up, they just don't care. It's depressing.
Re: (Score:3)
It's called a dead man's switch. You can set up something to delete your data if you don't log in every so often.
Re: (Score:2)
I believe cron job technology might be able to pull this off.
Re: (Score:2)
And then it comes down to "beyond reasonable doubt".
He provided 50 "passwords" off the top of his head. None worked. The chances that he "forgot" just the one for the court-ordered file that the court believe may have evidence - enought to generate a court order - but none others? Quite slim.
There's forgetfulness. There's reasonable doubt. There's being a dick in front of a court.
What you have to remember is that the law is written in stone, but it's interpreted by humans.
Re: (Score:2)
Have you never tried to remember something? The more you try, the more plausible seeming wrong answers you get? Then, days later you stumble upon the right answer and it's nothing like your guesses?
Most people have had that experience at least once or twice in their life.
Oh, God, what was that guy's name, John, tom, Jim, no, hrmm. Then weeks later someone else mentions his name. It was Franklin.
Re: (Score:2)
Eventually the disenfranchised (it's not hyphenated, btw) youth will be the older generation(s) and the ones who go all crazy voting these days will not be around anymore.
Re: (Score:2)
So you do not believe in Elon figuring out the cure for ageing soon, then?
Re: (Score:2)
Re: (Score:2)
The problem is that you cannot compel the impossible and you cannot prove that he remembers his password.
Re: (Score:2)
See though isn't that destruction of evidence? Which is pretty clearly illegal.
"Oh, you were looking for documents at my house? Sorry, I built my filing cabinet to shred and burn everything if I don't press a button every week" -- if you're arrested for (for example) financial fraud and you pull that kind of BS, you're in deep trouble. In fact, after you've started being investigated for something, any action to destroy potential evidence is super suspicious and may well be specifically illegal, even if