8 ms·
European Union dedicated questionnaire on the Encryption of Data
- Qlarto 10y agolol https://twitter.com/lukOlejnik/status/801498851957993474 https://twitter.com/lukOlejnik/status/801498851957993474
- devoply 10y agoStrong crypto is the only crypto. Everything else is an imposter.
- pmontra 10y agoSmart criminals will use strong encryption anyway and won't give the passwords to law enforcement both for data at rest and sent over the Internet. I'm encrypting my disk now, but I'll give the password to police if they have a search warrant. I'm encrypting so if somebody steals my computer they won't read my data. I think that almost everybody is like me. Weakening that encryption doesn't help me and doesn't help investigators. Sure, seeing strong encryption over the wire will ring alarms and identify sender and recipient. That works if they actually decrypt all the data sent over the Internet. The workaround for the tenaciuos criminals will be steganography. Narrower band but good enough in most cases. All that effort and damage to honest citizens for nothing.
- trendia 10y agoThe problem is: How do you handle cases where data appears to be encrypted but it isn't? Or, the data is encrypted but the suspect has forgotten the password?
- Gracana 10y agoThe state has little incentive to care about such issues. Look at the success and continued use of BS forensic science... False positives aren't a problem.
- paulddraper 10y agoHow do you handle cases where someone lies about a crime they've committed? Solving offenses without 100% certain evidence is by no means a new problem.
- vuanotinv 10y agoDumb people believe this is about whether encrypted data from criminals can be decrypted or not. It's not about that. It's about being able of charging a criminal with something just for using encryption. That way it won't matter if he refuses to give up the key.
- roblabla 10y agoExcept you can already use key disclosure laws[0] against those people. [0]: https://en.wikipedia.org/wiki/Key_disclosure_law https://en.wikipedia.org/wiki/Key_disclosure_law
- stale2002 10y agoThats why you use something like TrueCrypt to provide plausible deniability. You have 1 partition/password with the stuff you actually want to hide, and you have a second password/partition that just contains your porn collection. "Yes officer, I just use encryption to hide this stuff. Nothing illegal here. It is just embarrassing. Thats why I hide it." Thats really good plausible deniability.
- alkonaut 10y agoOr "This 500gb file is just a garbage file of random numbers I keep because I heard harddrives last longer if they aren't empty". In any reasonable legislation there shouldn't be a difference between not providing a password and not admitting you have anything encrypted at all (because no one can prove the difference anyway). An important thing that is often forgotten is that most many aren't challenged for encrypted contents in criminal cases but civil lawsuits where the burden of proof is (also) on the defendant because there is no "beyond reasonable doubt" . In that situation, the mere existence of e.g. a file transfer log with the movie file name + an encrypted disk is enough to end up with massive damages. In that situation you would be very interested to show your unencrypted data if you don't have the file in question.
- jdavis703 10y agoIf the only thing sitting between you and life in prison is murder evidence on your drive, vs. a few years for obstruction of justice for not handing over a password, you'd take the "life in prison" door? I don't think most defendants or lawyers behave as nobly as that.
- Legogris 10y agoI assume OP and most other people don't actually have incriminating evidence of things like murder on their hard-drives.
- fuzzy2 10y ago> but I'll give the password to police if they have a search warrant. That’s not right. In most countries, you don’t need to incriminate yourself. Before making wrongheaded decisions, contact a lawyer.
- sbuttgereit 10y agoThis. In the U.S. at least, the 5th amendment gives you the right not to incriminate yourself. A search warrant doesn't change that. Not all authentication methods are equal it appears. Fingerprint, facial recognition, other bio-metrics aren't considered the same as if you need to "speak" your password to someone. In other words, they can make you scan your finger or look into a camera, but they can't force you to tell them your password.
- loup-vaillant 10y agoHow about forcing you to type the password, behind a Mantle of Power if need be, such that they can decrypt the disk, without ever knowing the password?
- dTal 10y agoAs I understand it, in the US at least this is indeed the line. Same goes for combination vs keyed locks: you can't be forced to self-incriminate by sharing information, but you can be held in contempt for withholding evidence. I imagine it gets murky around things like SSH keys, which are technically a kind of password, but too big for a human to remember - and therefore must be "instantiated" in a physical device somewhere.
- semi-extrinsic 10y ago> I imagine it gets murky around things like SSH keys, which are technically a kind of password, but too big for a human to remember - and therefore must be "instantiated" in a physical device somewhere. A likely interpretation might be: an SSH key without a keyphrase is like a physical key, and you must hand it over, while a key with a keyphrase is like a combination lock, where you must hand it over but you are not required to state the keyphrase.
- dghughes 10y ago>but I'll give the password to police if they have a search warrant What if the police are wrong? Or like in Canada the police were trying to find the sources of journalists who wrote about corrupt police. And maybe in the US Trump's hate of journalists could mean something similar. My desire for personal privacy doesn't mean I am hiding anything. Maybe I don't want anyone to read my poetry or see family pictures nothing illegal but certainly private.
- nixgeek 10y agoAlmost nobody is entirely innocent under the law when sufficient scrutiny is applied, so giving LEO access to your computer invites a fishing expedition. IMO.
- mdpopescu 10y agoYep. I had that happen. Someone tipped the police that me and some friends were hacking computers and stealing credit cards. We were raided, gave access to the police to our computers, they found nothing related to cc fraud (of course) but then prosecuted us for some pirated games they found.
- CamperBob2 10y agoNo almost about it. "Give me six terabytes of data from the most honest of men and I will find something in them which will hang him. Probably before I make it past the boot sector." - Cardinal Richelieu
- devoply 10y agoBackdoors and weakened encryption means that there is no encryption going on at all. If any government official can get any information that means anyone can get that information as many of the people who break this stuff don't work for governments and governments are least technically capable actors. So it means there is effectively no encryption all if encryption is weakened or backdoored.
- jb613 10y agoThere is a difference between weakened and backdoored. Weakened is along the lines what you're saying - that likely others than just the governments can easily access, whereas backdoored (if done properly) means only the govt. Of course, this assumes a perfect world and that there is a proper way to backdoor - in the real world, adversaries simply attack the governments backdoors/keys. Nonetheless, given your context of "there is no encryption going on at all" I argue does not necessarily hold for a backdoor - or at least not at the outset and if done properly. If the govt backdoor is a key for which huge amount of care is taken to protect and take the extreme example of the govt encrypting the only copy of the key and firing it off in one direction into space - there is a backdoor but this is not necessarily equivalent to "no encryption at all".
- csydas 10y ago> I'm encrypting my disk now, but I'll give the password to police if they have a search warrant. I'm encrypting so if somebody steals my computer they won't read my data. I think that almost everybody is like me. I may be taking the word "everyone" too literally, but I think that part of the problem is that most people don't think like you and don't really understand the benefits of encryption and why it's a practical tool for absolutely everyone, not just terrorists, pedophiles, and drug dealers. There's a very big educational gap when it comes to encryption, and I don't think that most people can even cover the basics of it very well, which makes it extremely difficult at times to tell if law enforcement and politicians even understand the implications of what they propose beyond the immediate benefit to their operations. However, I do think that your position is probably the best that can help people to begin to understand why encryption is important; there still is a disconnect where most people don't understand that encryption is an all or nothing ordeal, or if they do, they accept the rationalization that the weakening of encryption is important for the security of the nation, whichever nation that may be. But in general, encryption is a problem because it operates in a blackbox for the majority of people, and it's incredibly easy for talking heads to say just about whatever they want on it without being challenged. It feels to me like strong encryption is one of those lessons that people are going to have to learn the hard way, much like how a lot of people learn about backing up data only after having a hard-drive go with important data on it. Though it would likely be difficult to prove, I think it's going to require that a government exploit or something intentionally weakened by a governmental actor be utilized by criminals to harm the public at large before people really get the idea on what government-approved encryption really means.
- detaro 10y agoSurprisingly interesting content for the clickbaity headline: Some excerpts from a questionnaire about how law enforcement deals with encryption answered by various EU governments, with esp. Poland calling for backdoors or weakened encryption. The full answers are here: https://www.asktheeu.org/en/request/input_provided_by_ms_on_question https://www.asktheeu.org/en/request/input_provided_by_ms_on_...
- kenoph 10y agoKiller use of Caps Lock and broken English. Proud of my country. On a serious note, I really do hope that we won't follow USA steps this time. But I'm afraid that the average person doesn't really care for or understand cryptography. Maybe a dickpic approach à la John Oliver could be useful as a way to raise awareness on the matter.
- ferongr 10y agoWhen don't need inflammatory personas like John Oliver in Europe.
- zombees 10y agoWould you care to elaborate? He's from Europe.
- musha68k 10y agoWhat can a "hacker" possibly have against John Oliver? He and his team were the most effective drivers for stronger Net Neutrality policies in the US. The man is a living legend. Edit: 12 million views on the abstract topic of Net Neutrality. That's what I would call a feat indeed: https://youtu.be/fpbOEoRrHyU https://youtu.be/fpbOEoRrHyU
- kenoph 10y agoWell I'm sure some people lost the respect for the guy after he jumped on the "vote for Hillary" bandwagon. But yeah, things like the Snowden interview, Net Neutrality and some other episodes are simply brilliant.
- guard-of-terra 10y agoYou don't need to take on cryptography to fight cybercrime. Cybercrime usually leaves huge trail of evidence. Usually in form of lost money (transactions) and bricked devices. Fighting cybercrime has different obstacles: it's usually cross-border, and its victims are usually common people. Nobody cares terribly much when a commoner loses $100. Even when there's a thousand of them. What you need to take on cryptography, is "to snoop". Why would you need that, huh?
- Zigurd 10y ago> Usually in form of lost money (transactions) and bricked devices. This is precisely why law enforcement doesn't need to weaken encryption nor weaken the rights of suspects and defendants. If there is a material crime, that crime has left a trail of evidence in the real world, especially a money trail. And if you think Leviathan needs unbounded powers or you'll be left as a tasty morsel in the state of nature, physics has always bounded state power, and injustices happen when state power is pushed beyond natural bounds.
- wiz21c 10y agoCan anybody point to organized lobbying efforts we can support to maintain all of this as far away as possible from Europe ? My country has refused to give the answers citing security reasons (according to the article).
- lucb1e 10y agoIn the Netherlands we have Bits of Freedom, they are mentioned in the article: > Thanks to Bits of Freedom, those answers are now public. That's called transparency. Another Dutch one I know is Privacy First. When elections come up we always have a vote advice website which is quite popular. You enter your opinion on some current topics (old example: joint strike fighter funding: continue or not?) and it computes which party's goals align the most. Privacy First had an interesting take on this: they looked at what parties pushed for in the past and matched that with what you would have wanted (focusing on privacy-related topics of course). Not looking at promises but at track record. Privacy First probably does other stuff as well, just like BoF, but I don't keep up. I don't know about other countries unfortunately.
- confounded 10y agoThe UK has the Open Rights Group and Privacy International.
- alkonaut 10y agoIf maths is outlawed only outlaws will have maths!
- pbininda 10y agoI find the german answers [1] surprisingly reasonable. High Five for the final answer: > 11. Are there other issues that you would like to raise in relation to encryption and the possible approach to these issues? Please share any relevant national experience or considerations arising from your practice that need to be taken into account. > Yes. A regulation to prohibit or to weaken encryption for telecommunication and digital services has to be ruled out, in order to protect privacy and business secrets. Go Germany! [1] https://www.asktheeu.org/en/request/3347/response/11727/attach/html/6/Encryption%20questionnaire%20DE.pdf.html https://www.asktheeu.org/en/request/3347/response/11727/atta...
- hannob 10y agoI come from Germany. The situation is complicated. The responsible politicians tend to make statements that are contradicting or don't make any sense. There have been multiple statements that at least could be interpreted as supportive of encryption regulation. In one occasion there was a joint statement by the french and german ministers of interior - with the slight problem that the french and german versions of the statement were different. Recently they created a new institution supposed to help decrypting messages. They never explained what that actually means. (I mean you simply can't decrypt properly designed crypto systems.) Germany isn't the privacy paradise that some people in the international debates sometimes like to see in it.
- grey-area 10y agoOn the other hand, it has a larger constituency in government who oppose undermining encryption than most other western nations and a good negative example in the recent past (the Stasi). Just look at the recent legislation passed in the UK, and the statements of Theresa May on encryption or the recent lawsuits by the FBI against Apple. It may be our best hope in stopping legislation mandating backdoors to encryption, which would damage everyone.
- Barrin92 10y agoThe most important difference is the parliamentary sovereignty of the UK. The biggest protector of privacy here in Germany is the constitution, and the Constitutional court rules fairly assertively on issues of privacy and civil rights, so what PM's do or don't do is not that important. The UK has no such safeguard due to governmental structure.
- catexception 10y agoRegulation of cryptography can help investigations but regulation is still a bad idea. A good explanation is something that my ethics professor said. It was something along the lines of "If a pen was used to write orders for the army to start WW2, should pens be banned?". The war would probably happened anyway even if pens were banned/regulated and it is certainly not the cause of the war. Cryptography is very similar: even if it would have been regulated, criminality will not just vanish.
- devoply 10y ago-
- jb613 10y ago"wants to regulate cryptography"??? - I suggest it's already in place. For example, if you wish to create crypto software or hardware (or in some cases even simply importing a crypto library) - for 2 sides to communicate requires sharing either the source, software binaries, or hardware itself - and if 1 of those is outside of the country then obviously export and/or import of the source/sw/hw occurs and therefore crypto controls come into effect.
- pstch 10y agoWhat is freedom of information if countries can decide on their own whether they will release their answers on not ? It is disappointing that rebuttals to information requests do not have to go through any judicial system.
- Mesfehr 10y agoStill, the ALL CAPS LOCK answer by Italy rocks.
- andybak 10y agoIt's a worrying testament to technical literacy of whoever compiled the answers.
- matthewaveryusa 10y agoI think this shows the state of our intel community. They've been focused on wide-net operations. If a target is high enough of an asset, why not go the easiest route of installing booby-trapped login screens, hardware keyloggers and what not? It's the easiest and most effective way to spy on someone (I'm sure they already do this.) This is all a ploy to spy on citizens. Period.
- caf 10y agoYou can probably read into this that their political masters are asking questions like "why can't you tell us who these 'lone-wolves' are before they attack?".
- matthewaveryusa 10y agoThat's a good point, but I don't think the tools used to aggregate and analyze all this data is sharp enough to find the needle of a lone wolf in such a large haystack that's the internet. The signal-to-noise on the internet is ridiculously low. Then again, I may be wrong.
- lgeek 10y agoI've collated the answers to some of the questions: * How often do you encounter encryption? The most common answer is 'often'. Germany does not collect this statistic. Czech Republic and Hungary: 'rarely', Latvia has both 'often' and 'almost always' in bold, UK 'almost always'. * Online encryption: most common one is e-comms (everywhere but Italy), followed by TOR (everywhere but Hungary and Poland). Denmark, Finland, Germany and the UK reported encountering all types of encryption on the form. * Offline encryption: it's not very clear what is an encrypted device (it includes computers) and what is an encrypting application (they give disk encryption tools as examples), but all countries except Poland selected devices and all countries except Italy selected applications * It sounds like the accused can only be compelled to disclose passwords or keys in the UK, but Italian LE would also like that very much, despite having reported that 'the current national law allows sufficiently effective securing of e-evidence when encrypted'. * In Croatia, Latvia and Poland they consider that the current national laws don't allow effective securing of encrypted evidence. The answer to this question is not available for Czech Republic and the UK. A few other interesting things I've noticed: Croatia: 'There is no practical experience' regarding 'intercepting/monitoring encrypted data flow'; 'Tools for decryption are used in less complex case [...]. Foreign companies’ services were not used so far.' Czech Republic: 'Additional intentional encryption is quite rare in most cases although encrypted mobile phones are more and more popular among members of certain organized crime groups.' Denmark: 'The main issue with trying to decrypt encrypted data is of a technical nature. Furthermore the equipment needed to break encryption is costly and the process itself takes a lot of time.'; 'In general terms, we can inform you that commercial software is among the tools used to decrypt data'; 'Decryption typically requires large hardware resources (processing power) as the encryption offered by service providers is very strong.' Estonia: 'The main problem is that communication or data are encrypted and if key is not available, it is not possible to decrypt them.' Finland: 'In case of full-disk encryption, which is rare, we have to either use brute force attacks, or try to obtain the credentials some other way'; 'We do not usually use private sector companies for decryption purposes, but of course a large part of the software/hardware used are commercial products'; 'Wireless criminal intelligence gathering can be challenging, because the LE sector has limited legal rights to gather for example WIFI data'; 'Sometimes insufficient computational capacity of our password-breaking platforms make the decrypting process too lengthy'; In general they talk about C&C servers for botnets quite a lot. Germany: Regarding intercepted encrypted comms: 'In many cases, analysis of actual communication content is not feasible.', 'A regulation to prohibit or to weaken encryption for telecommunication and digital services has to be ruled out, in order to protect privacy and business secrets.' Hungary: it sounds like they gave the form to the wrong dept? 'Our unit is not dealing with decryption, therefore we do not have any practical experience in this field.', 'Our unit is not dealing with such techniques.' Italy: covered in the OP Latvia: 'LV sees as clear added value of EC3’s encryption/decryption platform; LV also highly values the availability of the Europol Platform for Experts.'; Poland: mostly covered in the OP, I'll add 'The specialised computers (GPU clasters[sic]) which can decrypt encrypted e-evidences are very expensive.' UK: It reads like a polished PR piece, at least relative to the others. Provides non-answers. It's probably worth taking a closer look. For example to 'Under your national law, is it possible to intercept/monitor encrypted data flow to obtain decrypted data for the purposes of criminal proceeding?' they responded with 'Section 17 of the Regulation of Investigatory Powers Act 2000 prevents intercepted material from being used as evidence in legal proceedings.', which doesn't actually answer the question.