6 ms·

US jail sentences are crazy. But ... I think the UK approach here is not all that crazy. In a world with encryption, where does the balance lie between the need

US jail sentences are crazy. But ... I think the UK approach here is not all that crazy. In a world with encryption, where does the balance lie between the need to investigate crimes and the need to stop a country becoming a police state? NSA style "own it all" is clearly too far towards the police state end. But then preventing any and all investigations that involve a computer seems like an over-reaction towards the other end; targeted high-effort investigations have always been possible. And if you want to make that be the balance and allow specific, warrant-based human-driven investigations possible but block mass surveillance, then trying to regulate the details of the technology is a bad idea. Regulators won't be able to do that. It's the wrong approach. It's like the Clipper chip, the law specifying too much stuff. A law that says "you have to decrypt your files when asked" is at least simple and it doesn't scale to mass surveillance.

calgoo 11y ago
Well, it does scale: Just put a guy at the airport that scans all computers passing the check. You got nothing to hide, so why worry? The law clearly states that you need to hand over any password / key when asked. That is as bad or even worse then mass surveillance, because with mass surveillance you can at least try to be "safe" offline. With this "law", they could get to your data whenever they want. Much more of a police state that mass surveillance (at least in my opinion).
- andrei_says_ 11y ago
  Scan and possibly install something for everyone who handed admin level credentials.
- DanBC 11y ago
  Here's the law: http://www.legislation.gov.uk/ukpga/2000/23/contents http://www.legislation.gov.uk/ukpga/2000/23/contents Here's the bit we're talking about: http://www.legislation.gov.uk/ukpga/2000/23/part/III http://www.legislation.gov.uk/ukpga/2000/23/part/III You say > Just put a guy at the airport that scans all computers passing the check. This fails almost every step of the law. The person doing the asking is probably not authorised to do so; the information found isn't found as the result of a statutory instrument; the person doesn't have the reasonable belief that key disclosure is necessary to exercise a statutory instrument; it's not proportionate. > Much more of a police state that mass surveillance (at least in my opinion). If your attacker is a well funded Government you're fucked. This law provides some protections against abuse.
- sievebrain 11y ago
  As DanBC has pointed out, you're making assumptions about what the law says that aren't actually valid. There are quite a few safeguards in this law - it represents a compromise position.
grey-area 11y ago
The U.K. is already engaged in mass surveillance - see tempora.
koenigdavidmj 11y ago
Suppose I exchange letters with people on dead trees, but encrypt them first (using Solitaire [0], for example). Now that no computer is involved, do you still want to require I hand over this key? What if, instead of using the well-published Solitaire method, I use one of my own devising? (Now we're approximating Apple's situation of actually having to do work oneself, rather than provide the government a relatively small bit of data for them to do work.) 0: https://en.wikipedia.org/wiki/Solitaire_(cipher) https://en.wikipedia.org/wiki/Solitaire_(cipher)
- rtpg 11y ago
  Sure? I feel like you're trying to point out some absurdity here but I don't see it. People are compelled to do things in investigations all the time.
  - koenigdavidmj 11y ago
    On paper, this is more blatantly being demanded to write a self-incriminating document.
    - MichaelBurge 11y ago
      Not really, you're being asked to produce a self-incriminating document you already wrote. You'd have a better argument if you encrypted it in your head with a shared encryption key that your recipient also memorized before putting it in writing anywhere. Then it's like knowing a foreign language that the government can't read. In the US, we already force public companies to store potentially self-incriminating electronic documents in case of an investigation later. It's not too much of a stretch to force individuals to have a retention policy, in case they need to be investigated. I imagine other countries have similar laws. You could take a lesson from said companies and discuss anything remotely risky in-person rather than over monitored networks.
      - pdkl95 11y ago
        > Not really, you're being asked to produce a self-incriminating document you already wrote. The (paper) document will be produced and turned over. It isn't my fault if anybody doesn't understand how to read it. A warrant isn't a guarantee that evidence will be found or understood. > public companies Corporations are created by the state; they do not have rights. The state can put additional requirements on their offer of limited liability. People have rights against self-incrimination.
JoshTriplett 11y ago
> But then preventing any and all investigations that involve a computer seems like an over-reaction Refusing demands for encryption keys does not "prevent any and all investigations that involve a computer". It doesn't even prevent all investigations that involve a computer with an encrypted drive. > A law that says "you have to decrypt your files when asked" is at least simple and it doesn't scale to mass surveillance. I don't think even that much is reasonable, for exactly the same reason that you cannot be compelled to testify against yourself.

calgoo 11y ago

Well, it does scale: Just put a guy at the airport that scans all computers passing the check. You got nothing to hide, so why worry? The law clearly states that you need to hand over any password / key when asked. That is as bad or even worse then mass surveillance, because with mass surveillance you can at least try to be "safe" offline. With this "law", they could get to your data whenever they want. Much more of a police state that mass surveillance (at least in my opinion).

andrei_says_ 11y ago
Scan and possibly install something for everyone who handed admin level credentials.
DanBC 11y ago
Here's the law: http://www.legislation.gov.uk/ukpga/2000/23/contents http://www.legislation.gov.uk/ukpga/2000/23/contents Here's the bit we're talking about: http://www.legislation.gov.uk/ukpga/2000/23/part/III http://www.legislation.gov.uk/ukpga/2000/23/part/III You say > Just put a guy at the airport that scans all computers passing the check. This fails almost every step of the law. The person doing the asking is probably not authorised to do so; the information found isn't found as the result of a statutory instrument; the person doesn't have the reasonable belief that key disclosure is necessary to exercise a statutory instrument; it's not proportionate. > Much more of a police state that mass surveillance (at least in my opinion). If your attacker is a well funded Government you're fucked. This law provides some protections against abuse.
sievebrain 11y ago
As DanBC has pointed out, you're making assumptions about what the law says that aren't actually valid. There are quite a few safeguards in this law - it represents a compromise position.

grey-area 11y ago

The U.K. is already engaged in mass surveillance - see tempora.

koenigdavidmj 11y ago

Suppose I exchange letters with people on dead trees, but encrypt them first (using Solitaire [0], for example). Now that no computer is involved, do you still want to require I hand over this key? What if, instead of using the well-published Solitaire method, I use one of my own devising? (Now we're approximating Apple's situation of actually having to do work oneself, rather than provide the government a relatively small bit of data for them to do work.) 0: https://en.wikipedia.org/wiki/Solitaire_(cipher) https://en.wikipedia.org/wiki/Solitaire_(cipher)

rtpg 11y ago
Sure? I feel like you're trying to point out some absurdity here but I don't see it. People are compelled to do things in investigations all the time.
- koenigdavidmj 11y ago
  On paper, this is more blatantly being demanded to write a self-incriminating document.
  - MichaelBurge 11y ago
    Not really, you're being asked to produce a self-incriminating document you already wrote. You'd have a better argument if you encrypted it in your head with a shared encryption key that your recipient also memorized before putting it in writing anywhere. Then it's like knowing a foreign language that the government can't read. In the US, we already force public companies to store potentially self-incriminating electronic documents in case of an investigation later. It's not too much of a stretch to force individuals to have a retention policy, in case they need to be investigated. I imagine other countries have similar laws. You could take a lesson from said companies and discuss anything remotely risky in-person rather than over monitored networks.
    - pdkl95 11y ago
      > Not really, you're being asked to produce a self-incriminating document you already wrote. The (paper) document will be produced and turned over. It isn't my fault if anybody doesn't understand how to read it. A warrant isn't a guarantee that evidence will be found or understood. > public companies Corporations are created by the state; they do not have rights. The state can put additional requirements on their offer of limited liability. People have rights against self-incrimination.

JoshTriplett 11y ago

> But then preventing any and all investigations that involve a computer seems like an over-reaction Refusing demands for encryption keys does not "prevent any and all investigations that involve a computer". It doesn't even prevent all investigations that involve a computer with an encrypted drive. > A law that says "you have to decrypt your files when asked" is at least simple and it doesn't scale to mass surveillance. I don't think even that much is reasonable, for exactly the same reason that you cannot be compelled to testify against yourself.