3 ms·

In the UK if you won't give up your password (or essentially give means to decrypt data) when requested you can get 5 years for that. Encryption will not prote

In the UK if you won't give up your password (or essentially give means to decrypt data) when requested you can get 5 years for that. Encryption will not protect against the state in this case. Likely other countries will start to copy that...

alentist 5y ago
https://en.wikipedia.org/wiki/Deniable_encryption https://en.wikipedia.org/wiki/Deniable_encryption
gambiting 5y ago
I know it's the law already, but has it actually ever been used against anyone? I always thought it would be extremely difficult to successfully prosecute because if you give them "a" password and swore it's "the" password to the best of your knowledge you couldn't be accused of maliciously refusing to cooperate. I imagine they would still throw a book at you somewhere, but probably not the 5 years under this law.
- varispeed 5y ago
  Yes! Plenty of times e.g. https://www.techdirt.com/articles/20140116/09195525902/uk-man-jailed-not-giving-police-thumbstick-password.shtml https://www.techdirt.com/articles/20140116/09195525902/uk-ma... You can Google more easily...
  - gambiting 5y ago
    Yes, thank you for reminding me I can Google. From your own link - he said he forgot the password, which(I assume) in itself wasn't enough to prosecute, it was the fact that he eventually caved in and provided it 4 months later, so they got him on purposefully obstructing justice for 4 months. It's not clear if he could be successfully prosecuted for this crime if he never remembered the password.
    - varispeed 5y ago
      Here you have someone directly sentenced for not disclosing their password: https://www.bbc.com/news/uk-england-hampshire-45365464 https://www.bbc.com/news/uk-england-hampshire-45365464
      - gambiting 5y ago
        I mean, we can be doing this back and forth for a while, but again, to quote from the article: "Judge Christopher Parker did not accept Nicholson's "wholly inadequate" excuse that providing his password would expose information relating to cannabis." So basically he said "I know the password, but I'm not going to tell you". That's obstructing justice. My point is if you say you don't remember and maintain saying you don't, can you be persecuted purely on this one law. Because so far it looks like you can't.
        throwaway3699 5y ago
        This is the reason America's 5th amendment exists, people have the ability to not self-incriminate because it gives way for a different form of obstruction of justice, compelling people to speak under duress mainly. I've long wished most of the American constitution made it's way over to Britain. We've had many of the freedoms enshrined in it for centuries but a few, particularly the principle of freedom of speech, has been trampled over in the internet age.
        d110af5ccf 5y ago
        While the fifth amendment in the US is certainly a good principle, even it doesn't (currently) appear to provide a blanket protection against providing your passwords. My (likely incomplete) understanding of the current situation is that things are still ambiguous with many nuances not yet having been settled by the courts. On the one hand, there is federal precedent (https://law.justia.com/cases/federal/appellate-courts/ca3/17-3205/17-3205-2020-02-06.html https://law.justia.com/cases/federal/appellate-courts/ca3/17...) that the government must be able to demonstrate both that the defendant knows the password and that criminal evidence is known to exist on the device. The bar for both of these things appears to be fairly high. On the other hand, there is precedent at the state level in Pennsylvania (https://law.justia.com/cases/pennsylvania/supreme-court/2019/56-map-2018.html https://law.justia.com/cases/pennsylvania/supreme-court/2019...) that disclosure of passwords is testimonial in nature and therefore always (I think?) protected, even if you admit both to knowing the password and to the existence of criminal evidence. Note the different jurisdictions for the precedents here. In federal courts that fall under the third circuit (which includes Pennsylvania), the first one applies. In state courts within Pennsylvania, the second one applies. This oddity won't change until and unless the US Supreme Court chooses to hear a relevant case. So in Pennsylvania, the law is currently different depending on if the FBI or the local police is the one prosecuting you. Also note that from the first case, failure to provide the password is a form of civil contempt and therefore confinement is limited to 18 months at most.

alentist 5y ago

https://en.wikipedia.org/wiki/Deniable_encryption https://en.wikipedia.org/wiki/Deniable_encryption

gambiting 5y ago

I know it's the law already, but has it actually ever been used against anyone? I always thought it would be extremely difficult to successfully prosecute because if you give them "a" password and swore it's "the" password to the best of your knowledge you couldn't be accused of maliciously refusing to cooperate. I imagine they would still throw a book at you somewhere, but probably not the 5 years under this law.

varispeed 5y ago
Yes! Plenty of times e.g. https://www.techdirt.com/articles/20140116/09195525902/uk-man-jailed-not-giving-police-thumbstick-password.shtml https://www.techdirt.com/articles/20140116/09195525902/uk-ma... You can Google more easily...
- gambiting 5y ago
  Yes, thank you for reminding me I can Google. From your own link - he said he forgot the password, which(I assume) in itself wasn't enough to prosecute, it was the fact that he eventually caved in and provided it 4 months later, so they got him on purposefully obstructing justice for 4 months. It's not clear if he could be successfully prosecuted for this crime if he never remembered the password.
  - varispeed 5y ago
    Here you have someone directly sentenced for not disclosing their password: https://www.bbc.com/news/uk-england-hampshire-45365464 https://www.bbc.com/news/uk-england-hampshire-45365464
    - gambiting 5y ago
      I mean, we can be doing this back and forth for a while, but again, to quote from the article: "Judge Christopher Parker did not accept Nicholson's "wholly inadequate" excuse that providing his password would expose information relating to cannabis." So basically he said "I know the password, but I'm not going to tell you". That's obstructing justice. My point is if you say you don't remember and maintain saying you don't, can you be persecuted purely on this one law. Because so far it looks like you can't.
      - throwaway3699 5y ago
        This is the reason America's 5th amendment exists, people have the ability to not self-incriminate because it gives way for a different form of obstruction of justice, compelling people to speak under duress mainly. I've long wished most of the American constitution made it's way over to Britain. We've had many of the freedoms enshrined in it for centuries but a few, particularly the principle of freedom of speech, has been trampled over in the internet age.
        d110af5ccf 5y ago
        While the fifth amendment in the US is certainly a good principle, even it doesn't (currently) appear to provide a blanket protection against providing your passwords. My (likely incomplete) understanding of the current situation is that things are still ambiguous with many nuances not yet having been settled by the courts. On the one hand, there is federal precedent (https://law.justia.com/cases/federal/appellate-courts/ca3/17-3205/17-3205-2020-02-06.html https://law.justia.com/cases/federal/appellate-courts/ca3/17...) that the government must be able to demonstrate both that the defendant knows the password and that criminal evidence is known to exist on the device. The bar for both of these things appears to be fairly high. On the other hand, there is precedent at the state level in Pennsylvania (https://law.justia.com/cases/pennsylvania/supreme-court/2019/56-map-2018.html https://law.justia.com/cases/pennsylvania/supreme-court/2019...) that disclosure of passwords is testimonial in nature and therefore always (I think?) protected, even if you admit both to knowing the password and to the existence of criminal evidence. Note the different jurisdictions for the precedents here. In federal courts that fall under the third circuit (which includes Pennsylvania), the first one applies. In state courts within Pennsylvania, the second one applies. This oddity won't change until and unless the US Supreme Court chooses to hear a relevant case. So in Pennsylvania, the law is currently different depending on if the FBI or the local police is the one prosecuting you. Also note that from the first case, failure to provide the password is a form of civil contempt and therefore confinement is limited to 18 months at most.