4 ms·

On the other hand, not giving your password right away may be interpreted as an indication that you have something to hide (which you inevitably do), and they m

On the other hand, not giving your password right away may be interpreted as an indication that you have something to hide (which you inevitably do), and they may tag you for even further scrutiny. Also, UK: don't give your password, go to prison. Indefinitely.

NetStrikeForce 10y ago
> Also, UK: don't give your password, go to prison. Indefinitely. Identifinitely? I think even for terrorist charges you can only be held for so long?
shshhdhs 10y ago
Is there currently someone in UK prison for not giving up their password?
- sveiss 10y ago
  Only one case which I've seen mention of: http://www.bbc.co.uk/news/uk-25745989 http://www.bbc.co.uk/news/uk-25745989 He got an additional four months for the failure to disclose the passphrase, on top of five years three months for Terrorism Act offences.
  - polymatter 10y ago
    The Register reported a man getting 13 months (http://www.theregister.co.uk/2009/11/24/ripa_jfl?page=1 http://www.theregister.co.uk/2009/11/24/ripa_jfl?page=1) - though I couldn't find a better reference. BBC also reported on a teenager getting 16 weeks (http://www.bbc.co.uk/news/uk-england-11479831 http://www.bbc.co.uk/news/uk-england-11479831). In both cases it seems they were jailed purely for failure to disclose passwords and not in conjunction with any other offence.
stale2002 10y ago
What about plausible deniability keys? 1 password hides the real stuff, and the second one that you give to the police just gives them access to your porn collection (which someone very well might want to hide!).
- semi-extrinsic 10y ago
  Well, they don't matter wrt. the law. Either the prosecution is convinced you gave up all the keys (you win), or they believe you gave them a key that was just a distraction and they throw you in jail unless you give them the other key (you lose).
  - petertodd 10y ago
    Which is terrifying, as the whole point of plausibly deniable passwords is that attitude will end up with innocent people in jail for data that doesn't exist have.
    - semi-extrinsic 10y ago
      Until it's tested in court on a gray area case, it's hard to know for sure, but I'm pretty confident that UK courts would apply the "reasonable doubt" criterion to the fact that the defendant indeed posesses an encrypted volume they have not provided the keys to. I.e. if the defendant can reasonably claim that there are no further encrypted volumes on their device, I don't believe they would be imprisoned under this rule.
  - stale2002 10y ago
    How do you prove yourself innocent then? You did give them the keys. The point is that you look exactly the same as an innocent person. You are taking the only possible pathway to being proved innocent. It'd be like if I were to say "It doesn't matter what you do. The police are corrupt anyway, and will take you out back and shoot you no matter what. Guilty or innocent, if you get accused of a crime, you are dead." And if they are going to lock you up no matter what, then you may as well use multiple plausible deniability keys. As you said, it doesn't matter what you do, the outcome stays the same.
    - semi-extrinsic 10y ago
      > How do you prove yourself innocent then? You did give them the keys. Well, prosecution needs to have a legally convincing argument that indicates it is likely you have another encrypted partition you're not giving up keys to. In fact, the situation is no different from this: say you're a murder suspect and a neighbour saw you carrying several large heavy sacks into your car and you drove away. Say what really happened is that you went and buried some bags of toxic waste in some location, and then went and buried a dead body in another location. When asked by prosecution, you confess to burying toxic waste and tell them where. The rest of the outcome of the trial depends entirely on whether you've successfully convinced them that you just buried the toxic waste.
ookdatnog 10y ago
Indefinitely? So if the police digs up an old encrypted disc from your attic, and you legitimately forgot the password, you can be put away for the rest of your life?
nixgeek 10y ago
Please stop spreading FUD about RIPA, there is no "indefinitely" involved, the maximum sentence is two years, unless it relates to child indecency, in which case the maximum sentence is increased to five years. [1] [1] https://en.wikipedia.org/wiki/Key_disclosure_law#United_Kingdom https://en.wikipedia.org/wiki/Key_disclosure_law#United_King...
- loup-vaillant 10y ago
  I've heard the judge can then ask you again, and you can go back to jail if you refuse, because that's a separate offense or something.
  - nixgeek 10y ago
    Do you have a written citation for that, something from Out-Law.com (or equivalent), or from a qualified solicitor or barrister, which backs up the "I've heard..." up a little? Not trying to be a hard ass, but I don't think HN benefits from people spreading "legal facts" (c.f. indefinite imprisonment) with an authoritative written tone but without citing legal precedent, or a detailed analysis of the statute in question. I'm not a lawyer but I imagine if you were taken in front of the same Magistrate's Court or Crown Court, refused to decrypt the _same_ data a second time, were convicted under RIPA, sentenced, you'd have a damn good argument at appeal and it would very likely be quashed. IANAL. To put more substance behind this opinion, we can look at the Sentencing Council, which when drawing up sentencing guidance, frequently uses the term "fair and proportionate" [1] which is something of a cornerstone remark about how the judiciary should go about dealing with infractions of the law. Reasonable humans would say going to prison twice for the same thing is neither fair, nor proportionate. [1] https://www.sentencingcouncil.org.uk/news/item/new-sentencing-guidelines-introduced-for-corporate-manslaughter-health-and-safety-and-food-safety/ https://www.sentencingcouncil.org.uk/news/item/new-sentencin...
    - loup-vaillant 10y ago
      I have no substantial evidence to speak of. And I thank you for knocking me off my horse, I was being hasty. Have my upvotes. Now I checked Wikipedia about those laws, it appears France (my country) has a similar law since 2001. Bummer, I guess.

NetStrikeForce 10y ago

> Also, UK: don't give your password, go to prison. Indefinitely. Identifinitely? I think even for terrorist charges you can only be held for so long?

shshhdhs 10y ago

Is there currently someone in UK prison for not giving up their password?

sveiss 10y ago
Only one case which I've seen mention of: http://www.bbc.co.uk/news/uk-25745989 http://www.bbc.co.uk/news/uk-25745989 He got an additional four months for the failure to disclose the passphrase, on top of five years three months for Terrorism Act offences.
- polymatter 10y ago
  The Register reported a man getting 13 months (http://www.theregister.co.uk/2009/11/24/ripa_jfl?page=1 http://www.theregister.co.uk/2009/11/24/ripa_jfl?page=1) - though I couldn't find a better reference. BBC also reported on a teenager getting 16 weeks (http://www.bbc.co.uk/news/uk-england-11479831 http://www.bbc.co.uk/news/uk-england-11479831). In both cases it seems they were jailed purely for failure to disclose passwords and not in conjunction with any other offence.

stale2002 10y ago

What about plausible deniability keys? 1 password hides the real stuff, and the second one that you give to the police just gives them access to your porn collection (which someone very well might want to hide!).

semi-extrinsic 10y ago
Well, they don't matter wrt. the law. Either the prosecution is convinced you gave up all the keys (you win), or they believe you gave them a key that was just a distraction and they throw you in jail unless you give them the other key (you lose).
- petertodd 10y ago
  Which is terrifying, as the whole point of plausibly deniable passwords is that attitude will end up with innocent people in jail for data that doesn't exist have.
  - semi-extrinsic 10y ago
    Until it's tested in court on a gray area case, it's hard to know for sure, but I'm pretty confident that UK courts would apply the "reasonable doubt" criterion to the fact that the defendant indeed posesses an encrypted volume they have not provided the keys to. I.e. if the defendant can reasonably claim that there are no further encrypted volumes on their device, I don't believe they would be imprisoned under this rule.
- stale2002 10y ago
  How do you prove yourself innocent then? You did give them the keys. The point is that you look exactly the same as an innocent person. You are taking the only possible pathway to being proved innocent. It'd be like if I were to say "It doesn't matter what you do. The police are corrupt anyway, and will take you out back and shoot you no matter what. Guilty or innocent, if you get accused of a crime, you are dead." And if they are going to lock you up no matter what, then you may as well use multiple plausible deniability keys. As you said, it doesn't matter what you do, the outcome stays the same.
  - semi-extrinsic 10y ago
    > How do you prove yourself innocent then? You did give them the keys. Well, prosecution needs to have a legally convincing argument that indicates it is likely you have another encrypted partition you're not giving up keys to. In fact, the situation is no different from this: say you're a murder suspect and a neighbour saw you carrying several large heavy sacks into your car and you drove away. Say what really happened is that you went and buried some bags of toxic waste in some location, and then went and buried a dead body in another location. When asked by prosecution, you confess to burying toxic waste and tell them where. The rest of the outcome of the trial depends entirely on whether you've successfully convinced them that you just buried the toxic waste.

ookdatnog 10y ago

Indefinitely? So if the police digs up an old encrypted disc from your attic, and you legitimately forgot the password, you can be put away for the rest of your life?

nixgeek 10y ago

Please stop spreading FUD about RIPA, there is no "indefinitely" involved, the maximum sentence is two years, unless it relates to child indecency, in which case the maximum sentence is increased to five years. [1] [1] https://en.wikipedia.org/wiki/Key_disclosure_law#United_Kingdom https://en.wikipedia.org/wiki/Key_disclosure_law#United_King...

loup-vaillant 10y ago
I've heard the judge can then ask you again, and you can go back to jail if you refuse, because that's a separate offense or something.
- nixgeek 10y ago
  Do you have a written citation for that, something from Out-Law.com (or equivalent), or from a qualified solicitor or barrister, which backs up the "I've heard..." up a little? Not trying to be a hard ass, but I don't think HN benefits from people spreading "legal facts" (c.f. indefinite imprisonment) with an authoritative written tone but without citing legal precedent, or a detailed analysis of the statute in question. I'm not a lawyer but I imagine if you were taken in front of the same Magistrate's Court or Crown Court, refused to decrypt the _same_ data a second time, were convicted under RIPA, sentenced, you'd have a damn good argument at appeal and it would very likely be quashed. IANAL. To put more substance behind this opinion, we can look at the Sentencing Council, which when drawing up sentencing guidance, frequently uses the term "fair and proportionate" [1] which is something of a cornerstone remark about how the judiciary should go about dealing with infractions of the law. Reasonable humans would say going to prison twice for the same thing is neither fair, nor proportionate. [1] https://www.sentencingcouncil.org.uk/news/item/new-sentencing-guidelines-introduced-for-corporate-manslaughter-health-and-safety-and-food-safety/ https://www.sentencingcouncil.org.uk/news/item/new-sentencin...
  - loup-vaillant 10y ago
    I have no substantial evidence to speak of. And I thank you for knocking me off my horse, I was being hasty. Have my upvotes. Now I checked Wikipedia about those laws, it appears France (my country) has a similar law since 2001. Bummer, I guess.