5 ms·

the problem is not that you won't be able to use encryption (software), it's that if the police suspect you of anything and you have encrypted data that you're

the problem is not that you won't be able to use encryption (software), it's that if the police suspect you of anything and you have encrypted data that you're not willing to unlock you'll be punished by full extend of the law. But I think that could lead to better encryption software with plausible deniability like Veracrypt has

intricatedetail 6y ago
This already is a law in the UK. It is 5 years for not disclosing password.
- beckman466 6y ago
  wow that is scary.
  - atat7024 6y ago
    "Politics doesn't affect me" is unfortunately not true these days.
    - oarsinsync 6y ago
      Where “these days” is “the last two decades”, as far as RIPA goes.
- luxuryballs 6y ago
  dang so that means 5 years for forgetting your password too
  - CameronNemo 6y ago
    Cut to LE carrying around encrypted thumb drives to plant as evidence.
    - colejohnson66 6y ago
      Doesn’t even need to be encrypted; It could just be random data. Sufficient encryption is indistinguishable from random noise.
- fastball 6y ago
  Damn thank god for the 1st amendment.
- gerdesj 6y ago
  The Regulation of Investigatory Powers Act 2000 - https://www.legislation.gov.uk/ukpga/2000/23/contents https://www.legislation.gov.uk/ukpga/2000/23/contents It's a bit of a beast.
Tenoke 6y ago
>But I think that could lead to better encryption software with plausible deniability like Veracrypt has That works for encrypted drives and whatnot but it doesn't look especially applicable for any real-time communication.
- SCHiM 6y ago
  Except it is. IS used facebook for a lot of their communication. Imagine a code like: "Ten camels drink from the water at $some oasis". Meaning: "Attack $city at 10 AM tomorrow" Or "Meet at $place at 10 tomorrow". This has been documented extensively. All was perfectly legible by whoever can read conversations on facebook, but the meaning is lost.
  - Tenoke 6y ago
    Okay, yes sure but it does seem limiting.
akira2501 6y ago
> it's that if the police suspect you of anything and you have encrypted data So, back to steganography, then?
- mullingitover 6y ago
  One time pads are pretty great. Unbreakable with brute force attacks, indistinguishable from random numbers so you have plausible deniability about whether you're actually storing encrypted data.
  - candiodari 6y ago
    Are they unbreakable by the technique actually used by the average EU country though ? https://en.wikipedia.org/wiki/Key_disclosure_law https://en.wikipedia.org/wiki/Key_disclosure_law Generally it goes like this 1) you get a notice either from a judge or the police to provide unspecified assistance with an investigation (you are not told even 5 minutes in advance WHAT assistance, and there is a default gag order: if you inform a customer or ... that you handed over their info, you go to jail) 2) if you refuse to do something they charge you with a crime, not providing encryption keys is such a crime 3) look like EU "average" sentence is 2 to 5 years prison, plus 50k euros One time pads are obviously encrypted, meaning if you see one you know they're a key to something, so if you refuse to decrypt what is encrypted with them (or can't, let's not pretend these people know or care about what is and isn't possible beyond obvious cases like whatsapp), and a police officer cares, you may very well have a choice: decode or face 2 years prison. JUST for not giving a police officer full access, for example, to your phone, nothing else.
    - mullingitover 6y ago
      > One time pads are obviously encrypted Not obviously - you could have a 1GB blob of encrypted data, or a 1GB blob of random numbers, so there is plausible deniability. You're right that they're vulnerable to a rubber hose attack, but it's not a slam dunk case in court.
      - 6y ago
nness 6y ago
It seems more than a few countries already treat refusing to reveal your password or keys as contempt of the court or a breach in its own right: https://en.wikipedia.org/wiki/Key_disclosure_law https://en.wikipedia.org/wiki/Key_disclosure_law
Jenk 6y ago
It's not that. You can already be charged with obstruction of justice in many countries if you refuse to provide keys for encrypted drives. This is about prohibiting encrypted messaging in the first place. WhatsApp et al will be denied market access, app/play store entries for all encrypted chat apps will be removed or have versions shipped without encryption etc. The average HNer won't be that affected but the general public will. Access to encryption will be greatly reduced and most people won't even care or notice.
- beiller 6y ago
  Does it mean that https will be turned off for all EU websites? Can't wait!
  - hawk_ 6y ago
    or may be all the private keys need to be shared with the regulator...?
upofadown 6y ago
Just use an email server outside the EU that will not respond to EU warrants. Almost all email transfers are protected by TLS these days. So the authorities won't know you are using encryption in the first place. If they suspect you of something they would have to come to you to get your IMAP password to check if your email is encrypted. PGP is, as before, a technical counterargument to this sort of oppression. Perhaps the powers that be need to be again reminded of its existence. After all, the proposal is to backdoor all encryption software. That is simply impossible.

intricatedetail 6y ago

This already is a law in the UK. It is 5 years for not disclosing password.

beckman466 6y ago
wow that is scary.
- atat7024 6y ago
  "Politics doesn't affect me" is unfortunately not true these days.
  - oarsinsync 6y ago
    Where “these days” is “the last two decades”, as far as RIPA goes.
luxuryballs 6y ago
dang so that means 5 years for forgetting your password too
- CameronNemo 6y ago
  Cut to LE carrying around encrypted thumb drives to plant as evidence.
  - colejohnson66 6y ago
    Doesn’t even need to be encrypted; It could just be random data. Sufficient encryption is indistinguishable from random noise.
fastball 6y ago
Damn thank god for the 1st amendment.
gerdesj 6y ago
The Regulation of Investigatory Powers Act 2000 - https://www.legislation.gov.uk/ukpga/2000/23/contents https://www.legislation.gov.uk/ukpga/2000/23/contents It's a bit of a beast.

Tenoke 6y ago

>But I think that could lead to better encryption software with plausible deniability like Veracrypt has That works for encrypted drives and whatnot but it doesn't look especially applicable for any real-time communication.

SCHiM 6y ago
Except it is. IS used facebook for a lot of their communication. Imagine a code like: "Ten camels drink from the water at $some oasis". Meaning: "Attack $city at 10 AM tomorrow" Or "Meet at $place at 10 tomorrow". This has been documented extensively. All was perfectly legible by whoever can read conversations on facebook, but the meaning is lost.
- Tenoke 6y ago
  Okay, yes sure but it does seem limiting.

akira2501 6y ago

> it's that if the police suspect you of anything and you have encrypted data So, back to steganography, then?

mullingitover 6y ago
One time pads are pretty great. Unbreakable with brute force attacks, indistinguishable from random numbers so you have plausible deniability about whether you're actually storing encrypted data.
- candiodari 6y ago
  Are they unbreakable by the technique actually used by the average EU country though ? https://en.wikipedia.org/wiki/Key_disclosure_law https://en.wikipedia.org/wiki/Key_disclosure_law Generally it goes like this 1) you get a notice either from a judge or the police to provide unspecified assistance with an investigation (you are not told even 5 minutes in advance WHAT assistance, and there is a default gag order: if you inform a customer or ... that you handed over their info, you go to jail) 2) if you refuse to do something they charge you with a crime, not providing encryption keys is such a crime 3) look like EU "average" sentence is 2 to 5 years prison, plus 50k euros One time pads are obviously encrypted, meaning if you see one you know they're a key to something, so if you refuse to decrypt what is encrypted with them (or can't, let's not pretend these people know or care about what is and isn't possible beyond obvious cases like whatsapp), and a police officer cares, you may very well have a choice: decode or face 2 years prison. JUST for not giving a police officer full access, for example, to your phone, nothing else.
  - mullingitover 6y ago
    > One time pads are obviously encrypted Not obviously - you could have a 1GB blob of encrypted data, or a 1GB blob of random numbers, so there is plausible deniability. You're right that they're vulnerable to a rubber hose attack, but it's not a slam dunk case in court.
    - 6y ago

nness 6y ago

It seems more than a few countries already treat refusing to reveal your password or keys as contempt of the court or a breach in its own right: https://en.wikipedia.org/wiki/Key_disclosure_law https://en.wikipedia.org/wiki/Key_disclosure_law

Jenk 6y ago

It's not that. You can already be charged with obstruction of justice in many countries if you refuse to provide keys for encrypted drives. This is about prohibiting encrypted messaging in the first place. WhatsApp et al will be denied market access, app/play store entries for all encrypted chat apps will be removed or have versions shipped without encryption etc. The average HNer won't be that affected but the general public will. Access to encryption will be greatly reduced and most people won't even care or notice.

beiller 6y ago
Does it mean that https will be turned off for all EU websites? Can't wait!
- hawk_ 6y ago
  or may be all the private keys need to be shared with the regulator...?

upofadown 6y ago

Just use an email server outside the EU that will not respond to EU warrants. Almost all email transfers are protected by TLS these days. So the authorities won't know you are using encryption in the first place. If they suspect you of something they would have to come to you to get your IMAP password to check if your email is encrypted. PGP is, as before, a technical counterargument to this sort of oppression. Perhaps the powers that be need to be again reminded of its existence. After all, the proposal is to backdoor all encryption software. That is simply impossible.