3 ms·

Back when the Regulation of Investigatory Powers Bill was being circulated, to much outcry from technical folk, someone encrypted a file with a provocative name

Back when the Regulation of Investigatory Powers Bill was being circulated, to much outcry from technical folk, someone encrypted a file with a provocative name and sent it to the Home Secretary for exactly that reason, as a form of demonstation-cum-protest. Suddenly the Minister[0] possessed a file which he couldn't decrypt on demand. Would he consider amending the Bill to remove penalties for such eventualities? Of course not, nothing was changed. If you possess the bytes you'll do the time. Delete everything that is unnecessary as soon as its usefulness has expired - big corps learned that lesson, for other reasons, in the early 2000s. [0] well one of his staff

dmix 9y ago
> Suddenly the Minister[0] possessed a file which he couldn't decrypt on demand. While I entirely sympathise with this idea abstractly, so much of law depends on the context of actions where it's easy to dismiss this stunt. Merely having encrypted data in your possession is technically not within the scope of the law if the context is "as part of a counterterrorism investigation" and if the person could reasonably be expected to decrypt it (which would imply they were both the person to encrypt in the first place AND with the means to decrypt it - as this politician clearly wasn't). Wrongful convictions and dragnet searches are the serious consequence of these laws, yes, but the real test comes when it's hateable/despicable people at risk. The problem with these laws isn't that it's fundamentally or potentially arbitrary, it's that it's wrong even when it's not arbitrary. And the mere fact of a police investigation or allegation is not sufficient to cross that line. People should have the right to encrypt anything they want without being coerced into decrypting it. There are more than enough means for police in our modern technological era to convict terrorists/criminals and prevent conspiracies without having total access to all data. And the costs of removing that right is much higher than the rewards of a few extra convictions.
- rocqua 9y ago
  I'd guess that authorities would also have issues with situations where one purposely encrypts a hard-drive and disables decryption until later / confirmed safe by a third party. At the very least, that is what "Possession of encrypted data whilst being unable to decrypt it" sounds like. It then becomes a grey area between having been sent encrypted data, and having used the previously mentioned scheme to avoid decryption. I also wonder how this interacts with the new 5-tap SOS function on iPhones.
- confounded 9y ago
  > Merely having encrypted data in your possession is technically not within the scope of the law if the context is "as part of a counter-terrorism investigation" Not quite; the bar is not as high as an existing 'terrorism' investigation. To quote RIPA (2000)[0], if anyone authorized has the belief (upon reasonable grounds), that (3) A disclosure requirement in respect of any protected information is necessary on grounds falling within this subsection if it is necessary— (a) in the interests of national security; (b) for the purpose of preventing or detecting crime; or (c) in the interests of the economic well-being of the United Kingdom. It is very very easy to imagine how this could be abused. Saying that you'd like to slap POTUS or May on Twitter could conceivably meet grounds for (2), and (3) is so broad that it's possible to imagine it could be triggered by something like being Alexandra Elbakyan of SciHub, or Sundae of The Pirate Bay. Depending on the mood of the press and the 'authorized persons', why not any old person caught using BitTorrent, or cracking DRM? [0]: http://www.legislation.gov.uk/ukpga/2000/23/pdfs/ukpga_20000023_en.pdf http://www.legislation.gov.uk/ukpga/2000/23/pdfs/ukpga_20000...

dmix 9y ago

> Suddenly the Minister[0] possessed a file which he couldn't decrypt on demand. While I entirely sympathise with this idea abstractly, so much of law depends on the context of actions where it's easy to dismiss this stunt. Merely having encrypted data in your possession is technically not within the scope of the law if the context is "as part of a counterterrorism investigation" and if the person could reasonably be expected to decrypt it (which would imply they were both the person to encrypt in the first place AND with the means to decrypt it - as this politician clearly wasn't). Wrongful convictions and dragnet searches are the serious consequence of these laws, yes, but the real test comes when it's hateable/despicable people at risk. The problem with these laws isn't that it's fundamentally or potentially arbitrary, it's that it's wrong even when it's not arbitrary. And the mere fact of a police investigation or allegation is not sufficient to cross that line. People should have the right to encrypt anything they want without being coerced into decrypting it. There are more than enough means for police in our modern technological era to convict terrorists/criminals and prevent conspiracies without having total access to all data. And the costs of removing that right is much higher than the rewards of a few extra convictions.

rocqua 9y ago
I'd guess that authorities would also have issues with situations where one purposely encrypts a hard-drive and disables decryption until later / confirmed safe by a third party. At the very least, that is what "Possession of encrypted data whilst being unable to decrypt it" sounds like. It then becomes a grey area between having been sent encrypted data, and having used the previously mentioned scheme to avoid decryption. I also wonder how this interacts with the new 5-tap SOS function on iPhones.
confounded 9y ago
> Merely having encrypted data in your possession is technically not within the scope of the law if the context is "as part of a counter-terrorism investigation" Not quite; the bar is not as high as an existing 'terrorism' investigation. To quote RIPA (2000)[0], if anyone authorized has the belief (upon reasonable grounds), that (3) A disclosure requirement in respect of any protected information is necessary on grounds falling within this subsection if it is necessary— (a) in the interests of national security; (b) for the purpose of preventing or detecting crime; or (c) in the interests of the economic well-being of the United Kingdom. It is very very easy to imagine how this could be abused. Saying that you'd like to slap POTUS or May on Twitter could conceivably meet grounds for (2), and (3) is so broad that it's possible to imagine it could be triggered by something like being Alexandra Elbakyan of SciHub, or Sundae of The Pirate Bay. Depending on the mood of the press and the 'authorized persons', why not any old person caught using BitTorrent, or cracking DRM? [0]: http://www.legislation.gov.uk/ukpga/2000/23/pdfs/ukpga_20000023_en.pdf http://www.legislation.gov.uk/ukpga/2000/23/pdfs/ukpga_20000...