5 ms·

In many places, law enforcement will pressure but not torture you to provide decryption keys, maybe imprison you for a while, fine you, ... But that may be pre

In many places, law enforcement will pressure but not torture you to provide decryption keys, maybe imprison you for a while, fine you, ... But that may be preferable than them knowing about all those highly illegal nuclear doomsday space arms technology knowledge deals you've brokered, or that collection of child porn, or those detailed assassination plans, or whatever. Maybe the authorities suspect something, maybe a SWAT team will snatch your laptop, but if all evidence is in there and encrypted, you may get off with a lot less than otherwise.

kwhitefoot 6y ago
In the UK you might well be in prison for five years for refusing to hand over the keys. https://www.schneier.com/blog/archives/2007/10/uk_police_can_n.html https://www.schneier.com/blog/archives/2007/10/uk_police_can... Not sure what the situation is now.
- DanBC 6y ago
  Section 49 to force key disclosure should only happen if: + The person being given the notice has the key + Investigators need the key to prevent or detect crime + Disclosure is proportionate + They can't get the encrypted material by other means Not complying with the is a criminal offence. The maximum sentence is 2 years, unless it's a case involving child sexual exploitation or national security where the maximum sentence is 5 years. There is a code of practice for use of these powers here: https://www.gov.uk/government/publications/code-of-practice-for-investigation-of-protected-electronic-information https://www.gov.uk/government/publications/code-of-practice-... I think that properly regulated key disclosure powers are important. I'm not sure we're (the UK) are getting it right with RIPA. I'd want to see stronger audit and oversight of the S49 notices, and better advice given to people who are served S49 notices. For example: I have no idea how many people are served S49 notices, and I don't really know how to find out. I don't know how many people have been imprisoned for not disclosing keys; I don't know what sentences they've been given; and I'm not clear on how to find that out. I feel that it should be easier for citizens to have clear data about these really intrusive powers. EDIT: I just found this page, and it seems like it's small numbers of people. But still, it's a bit worrying. https://wiki.openrightsgroup.org/wiki/Regulation_of_Investigatory_Powers_Act_2000/Part_III#Cases https://wiki.openrightsgroup.org/wiki/Regulation_of_Investig...
  - Jaruzel 6y ago
    > Investigators need the key to prevent or detect crime That's a bit scary. 'Detect crime' could be pure speculation on the polices' part. "We think you've done something bad, let us see the contents of your phone. No we don't have any evidence already as we're detecting the crime right now."
    - DanBC 6y ago
      I'm not sure that would be proportionate. It's not great, but it's better than before where this kind of crime detection had much less regulation.
      - tupac_speedrap 6y ago
        Get out spook.
    - refurb 6y ago
      Maybe I’m wrong, but I’m going to assume that the UK requires at least some evidence (reviewed by a judge) of a crime being committed or is about to be committed before they can throw you in jail for not giving the code to your phone.
- worewood 6y ago
  Hidden operating system is the way to go. Usbkill turns the machine off, when asked you supply the public password.
  - londons_explore 6y ago
    Investigators will say "you sent this email to your dad at 09:29 on Tuesday, yet it wasn't sent from your phone or laptop according to device logs. You either have another device you haven't given us, or you haven't decrypted the right partition".
    - ta17711771 6y ago
      You sent shit to your dad from the wrong machine/partition.
    - R0b0t1 6y ago
      "Prove it."
    - Nasrudith 6y ago
      Bootdrives with no cache are the perfect answer to this through a lawywe."USB boot drive. There are no logs kept to it. I'm not hiding anything, it is just good sense to use a computer which doesn't persist any state limiting any malware to session only in the very worst case."
tyingq 6y ago
Veracrypt has a hidden volume feature where you give up a distress key, and a hopefully plausible second volume is decrypted instead of the real one.
giomasce 6y ago
Also, you can decide to reveal your secret after having discussed the matter with a lawyer.

kwhitefoot 6y ago

In the UK you might well be in prison for five years for refusing to hand over the keys. https://www.schneier.com/blog/archives/2007/10/uk_police_can_n.html https://www.schneier.com/blog/archives/2007/10/uk_police_can... Not sure what the situation is now.

DanBC 6y ago
Section 49 to force key disclosure should only happen if: + The person being given the notice has the key + Investigators need the key to prevent or detect crime + Disclosure is proportionate + They can't get the encrypted material by other means Not complying with the is a criminal offence. The maximum sentence is 2 years, unless it's a case involving child sexual exploitation or national security where the maximum sentence is 5 years. There is a code of practice for use of these powers here: https://www.gov.uk/government/publications/code-of-practice-for-investigation-of-protected-electronic-information https://www.gov.uk/government/publications/code-of-practice-... I think that properly regulated key disclosure powers are important. I'm not sure we're (the UK) are getting it right with RIPA. I'd want to see stronger audit and oversight of the S49 notices, and better advice given to people who are served S49 notices. For example: I have no idea how many people are served S49 notices, and I don't really know how to find out. I don't know how many people have been imprisoned for not disclosing keys; I don't know what sentences they've been given; and I'm not clear on how to find that out. I feel that it should be easier for citizens to have clear data about these really intrusive powers. EDIT: I just found this page, and it seems like it's small numbers of people. But still, it's a bit worrying. https://wiki.openrightsgroup.org/wiki/Regulation_of_Investigatory_Powers_Act_2000/Part_III#Cases https://wiki.openrightsgroup.org/wiki/Regulation_of_Investig...
- Jaruzel 6y ago
  > Investigators need the key to prevent or detect crime That's a bit scary. 'Detect crime' could be pure speculation on the polices' part. "We think you've done something bad, let us see the contents of your phone. No we don't have any evidence already as we're detecting the crime right now."
  - DanBC 6y ago
    I'm not sure that would be proportionate. It's not great, but it's better than before where this kind of crime detection had much less regulation.
    - tupac_speedrap 6y ago
      Get out spook.
  - refurb 6y ago
    Maybe I’m wrong, but I’m going to assume that the UK requires at least some evidence (reviewed by a judge) of a crime being committed or is about to be committed before they can throw you in jail for not giving the code to your phone.
worewood 6y ago
Hidden operating system is the way to go. Usbkill turns the machine off, when asked you supply the public password.
- londons_explore 6y ago
  Investigators will say "you sent this email to your dad at 09:29 on Tuesday, yet it wasn't sent from your phone or laptop according to device logs. You either have another device you haven't given us, or you haven't decrypted the right partition".
  - ta17711771 6y ago
    You sent shit to your dad from the wrong machine/partition.
  - R0b0t1 6y ago
    "Prove it."
  - Nasrudith 6y ago
    Bootdrives with no cache are the perfect answer to this through a lawywe."USB boot drive. There are no logs kept to it. I'm not hiding anything, it is just good sense to use a computer which doesn't persist any state limiting any malware to session only in the very worst case."

tyingq 6y ago

Veracrypt has a hidden volume feature where you give up a distress key, and a hopefully plausible second volume is decrypted instead of the real one.

giomasce 6y ago

Also, you can decide to reveal your secret after having discussed the matter with a lawyer.