3 ms·

>possessing encrypted data (while being unwilling or unable to decrypt How does this work with things like DRM? What if you have media on your phone from somet

by mfoy_ 9y ago

>possessing encrypted data (while being unwilling or unable to decrypt How does this work with things like DRM? What if you have media on your phone from something like Spotify or Netflix that's presumably encrypted or protected in some way, that you cannot decrypt if your subscription expires...

pricechild 9y ago
My naive understanding of my country's laws is that it doesn't. I could have a file filled with /dev/random and the law would still apply.
dingaling 9y ago
Back when the Regulation of Investigatory Powers Bill was being circulated, to much outcry from technical folk, someone encrypted a file with a provocative name and sent it to the Home Secretary for exactly that reason, as a form of demonstation-cum-protest. Suddenly the Minister[0] possessed a file which he couldn't decrypt on demand. Would he consider amending the Bill to remove penalties for such eventualities? Of course not, nothing was changed. If you possess the bytes you'll do the time. Delete everything that is unnecessary as soon as its usefulness has expired - big corps learned that lesson, for other reasons, in the early 2000s. [0] well one of his staff
- dmix 9y ago
  > Suddenly the Minister[0] possessed a file which he couldn't decrypt on demand. While I entirely sympathise with this idea abstractly, so much of law depends on the context of actions where it's easy to dismiss this stunt. Merely having encrypted data in your possession is technically not within the scope of the law if the context is "as part of a counterterrorism investigation" and if the person could reasonably be expected to decrypt it (which would imply they were both the person to encrypt in the first place AND with the means to decrypt it - as this politician clearly wasn't). Wrongful convictions and dragnet searches are the serious consequence of these laws, yes, but the real test comes when it's hateable/despicable people at risk. The problem with these laws isn't that it's fundamentally or potentially arbitrary, it's that it's wrong even when it's not arbitrary. And the mere fact of a police investigation or allegation is not sufficient to cross that line. People should have the right to encrypt anything they want without being coerced into decrypting it. There are more than enough means for police in our modern technological era to convict terrorists/criminals and prevent conspiracies without having total access to all data. And the costs of removing that right is much higher than the rewards of a few extra convictions.
  - rocqua 9y ago
    I'd guess that authorities would also have issues with situations where one purposely encrypts a hard-drive and disables decryption until later / confirmed safe by a third party. At the very least, that is what "Possession of encrypted data whilst being unable to decrypt it" sounds like. It then becomes a grey area between having been sent encrypted data, and having used the previously mentioned scheme to avoid decryption. I also wonder how this interacts with the new 5-tap SOS function on iPhones.
  - confounded 9y ago
    > Merely having encrypted data in your possession is technically not within the scope of the law if the context is "as part of a counter-terrorism investigation" Not quite; the bar is not as high as an existing 'terrorism' investigation. To quote RIPA (2000)[0], if anyone authorized has the belief (upon reasonable grounds), that (3) A disclosure requirement in respect of any protected information is necessary on grounds falling within this subsection if it is necessary— (a) in the interests of national security; (b) for the purpose of preventing or detecting crime; or (c) in the interests of the economic well-being of the United Kingdom. It is very very easy to imagine how this could be abused. Saying that you'd like to slap POTUS or May on Twitter could conceivably meet grounds for (2), and (3) is so broad that it's possible to imagine it could be triggered by something like being Alexandra Elbakyan of SciHub, or Sundae of The Pirate Bay. Depending on the mood of the press and the 'authorized persons', why not any old person caught using BitTorrent, or cracking DRM? [0]: http://www.legislation.gov.uk/ukpga/2000/23/pdfs/ukpga_20000023_en.pdf http://www.legislation.gov.uk/ukpga/2000/23/pdfs/ukpga_20000...
confounded 9y ago
The point is that the law doesn't make any sense, and can be used to intimidate and imprison difficult people, at the Crown's discretion.
BearGoesChirp 9y ago
The idea is to create crimes that they can apply to anyone. Technically they apply to everyone, but they can then use selective enforcement based on criteria that the general public would never have openly tolerated as a law.
askvictor 9y ago
> How does this work with things like DRM? What if you have media on your phone from something like Spotify or Netflix that's presumably encrypted or protected in some way, that you cannot decrypt if your subscription expires... Interesting point, but I think in this situation they'd be putting pressure on the media provider to decrypt it for them (since the media provider is the one in control of the encryption, not the consumer). That's assuming said media provider is in a jurisdiction that the relevant govt has some control over, and/or media provider is compliant. Here's a thought experiment: suppose ISIS (or your preferred terrorist organisation of the day) set up a media service for users to share videos (or other media) that are protected by DRM. The media service can disable the viewing of said content on a whim. A person using this service has their phone/computer confiscated, but the authorities are powerless to gain access to the content due to the DRM. Is this person liable under these laws, even though the encryption is outside their control?
m-p-3 9y ago
Imagine a malicious attack on a target where a cryptolocker is pushed to a victim, an anonymous tip is sent to the authority about the same person holding potential documents related to terrorism, and the attacker just throw away the key. How can you even defend yourself?

by mfoy_ 9y ago

pricechild 9y ago

My naive understanding of my country's laws is that it doesn't. I could have a file filled with /dev/random and the law would still apply.

dingaling 9y ago

Back when the Regulation of Investigatory Powers Bill was being circulated, to much outcry from technical folk, someone encrypted a file with a provocative name and sent it to the Home Secretary for exactly that reason, as a form of demonstation-cum-protest. Suddenly the Minister[0] possessed a file which he couldn't decrypt on demand. Would he consider amending the Bill to remove penalties for such eventualities? Of course not, nothing was changed. If you possess the bytes you'll do the time. Delete everything that is unnecessary as soon as its usefulness has expired - big corps learned that lesson, for other reasons, in the early 2000s. [0] well one of his staff

dmix 9y ago
> Suddenly the Minister[0] possessed a file which he couldn't decrypt on demand. While I entirely sympathise with this idea abstractly, so much of law depends on the context of actions where it's easy to dismiss this stunt. Merely having encrypted data in your possession is technically not within the scope of the law if the context is "as part of a counterterrorism investigation" and if the person could reasonably be expected to decrypt it (which would imply they were both the person to encrypt in the first place AND with the means to decrypt it - as this politician clearly wasn't). Wrongful convictions and dragnet searches are the serious consequence of these laws, yes, but the real test comes when it's hateable/despicable people at risk. The problem with these laws isn't that it's fundamentally or potentially arbitrary, it's that it's wrong even when it's not arbitrary. And the mere fact of a police investigation or allegation is not sufficient to cross that line. People should have the right to encrypt anything they want without being coerced into decrypting it. There are more than enough means for police in our modern technological era to convict terrorists/criminals and prevent conspiracies without having total access to all data. And the costs of removing that right is much higher than the rewards of a few extra convictions.
- rocqua 9y ago
  I'd guess that authorities would also have issues with situations where one purposely encrypts a hard-drive and disables decryption until later / confirmed safe by a third party. At the very least, that is what "Possession of encrypted data whilst being unable to decrypt it" sounds like. It then becomes a grey area between having been sent encrypted data, and having used the previously mentioned scheme to avoid decryption. I also wonder how this interacts with the new 5-tap SOS function on iPhones.
- confounded 9y ago
  > Merely having encrypted data in your possession is technically not within the scope of the law if the context is "as part of a counter-terrorism investigation" Not quite; the bar is not as high as an existing 'terrorism' investigation. To quote RIPA (2000)[0], if anyone authorized has the belief (upon reasonable grounds), that (3) A disclosure requirement in respect of any protected information is necessary on grounds falling within this subsection if it is necessary— (a) in the interests of national security; (b) for the purpose of preventing or detecting crime; or (c) in the interests of the economic well-being of the United Kingdom. It is very very easy to imagine how this could be abused. Saying that you'd like to slap POTUS or May on Twitter could conceivably meet grounds for (2), and (3) is so broad that it's possible to imagine it could be triggered by something like being Alexandra Elbakyan of SciHub, or Sundae of The Pirate Bay. Depending on the mood of the press and the 'authorized persons', why not any old person caught using BitTorrent, or cracking DRM? [0]: http://www.legislation.gov.uk/ukpga/2000/23/pdfs/ukpga_20000023_en.pdf http://www.legislation.gov.uk/ukpga/2000/23/pdfs/ukpga_20000...

confounded 9y ago

The point is that the law doesn't make any sense, and can be used to intimidate and imprison difficult people, at the Crown's discretion.

BearGoesChirp 9y ago

The idea is to create crimes that they can apply to anyone. Technically they apply to everyone, but they can then use selective enforcement based on criteria that the general public would never have openly tolerated as a law.

askvictor 9y ago

> How does this work with things like DRM? What if you have media on your phone from something like Spotify or Netflix that's presumably encrypted or protected in some way, that you cannot decrypt if your subscription expires... Interesting point, but I think in this situation they'd be putting pressure on the media provider to decrypt it for them (since the media provider is the one in control of the encryption, not the consumer). That's assuming said media provider is in a jurisdiction that the relevant govt has some control over, and/or media provider is compliant. Here's a thought experiment: suppose ISIS (or your preferred terrorist organisation of the day) set up a media service for users to share videos (or other media) that are protected by DRM. The media service can disable the viewing of said content on a whim. A person using this service has their phone/computer confiscated, but the authorities are powerless to gain access to the content due to the DRM. Is this person liable under these laws, even though the encryption is outside their control?

m-p-3 9y ago

Imagine a malicious attack on a target where a cryptolocker is pushed to a victim, an anonymous tip is sent to the authority about the same person holding potential documents related to terrorism, and the attacker just throw away the key. How can you even defend yourself?