20 ms·

UK law says provide key to encrypted data or go to jail

164 points by bougiefever 13y ago

jumblesale 13y ago
July 13, 2012 A few of us kicked and shouted about this when this was proposed. If you'd like an example of how this is being abused, El Reg has a good article from 2009: http://www.theregister.co.uk/2009/11/24/ripa_jfl/ http://www.theregister.co.uk/2009/11/24/ripa_jfl/
- Ygg2 13y ago
  So this is one of those laws that everyone broke.
  - tehwalrus 13y ago
    nope, it's one of those laws that the police can use on anyone they don't like, anytime. There was a good article of how this "criminalise everyone, and then only prosecute the ones you don't like" attitude was essentially how the US operates by default nowadays - It was on HN a few months ago but I can't find it now.
    - Ygg2 13y ago
      Think that was the point of the laws everyone broke.
      - tehwalrus 13y ago
        apologies if I wasn't clear; there are plenty of laws "still on the statute book" which everyone breaks but which would never be prosecuted. e.g. copying music from CD to iPod before about 2010, or compulsory archery practise with the parish vicar on the village green on Sundays. I was drawing the distinction between that type, which are simply archaic, and this type, which have been designed to incriminate everyone.
  - apricot13 13y ago
    there was a chap who had this law used against him a few years back, I don't remember what happened though but it was a big deal at the time. It was to do with encrypting random data for physics or a game or something and the government got hold of it but because the data was encrypted one way he couldn't give them a key and he was going to go to prison for two years. I've heard nothing about it since though with all this PRISM stuff and people encrypting their emails I'm surprised it hasn't resurfaced sooner.
- mseebach 13y ago
  The case is absolutely awful, but he was jailed for refusing to hand over the key, which is (according to the article) exactly what he did. The article is very kind to the suspect here, and nowhere does it even suggest that he had lost the key or otherwise wasn't able to decrypt the files.
  - deleted 13y ago
    [deleted]
  - cmircea 13y ago
    Since when is refusing to incriminate oneself punishable with jail time? Last time I checked it wasn't. Refusing to provide encryption keys is the same thing. There might be illegal data, there might not be. It's the duty of the police to prove it, not the accused. Innocent until proven guilty? Not in the UK.
    - lotsofcows 13y ago
      We don't have anti-incrimination laws. If you go in front of a judge, the judge has the right to all relevant information with which to make a decision. What happened here is that the judge asked for the keys and was refused them. Plain and simple. If you don't trust your judicial system to (eventually) get to the right answer, you've got bigger problems.
      - tyrion 13y ago
        "there can be no doubt that the right to remain silent under police questioning and the privilege against self-incrimination are generally recognised international standards which lie at the heart of the notion of a fair procedure" from http://en.wikipedia.org/wiki/Right_to_silence_in_England_and_Wales http://en.wikipedia.org/wiki/Right_to_silence_in_England_and... (and cite-note 15)
        lotsofcows 13y ago
        It's interesting that the article conflates right to silence and self-incrimination, I thought they were kept separate. It mentions the exception for encryption but doesn't mention any exception for safe codes which is what my line of thinking was based on. That being said, I can't find a reference to that either...
- majke 13y ago
  Good article! > He returned to Paddington Green station as appointed on 2 December, and was re-arrested for carrying a pocket knife. FTR, carrying a pocket knife is perfectly legal in the UK (assuming it was within a certain size). > Officers bearing sub-machine guns broke down the door of JFL's flat. He rang local police before realising CTC had come for him. [...] JFL maintained his silence throughout the one hour time limit imposed by the notice. He was charged with ten offences under section 53 of RIPA Part III, reflecting the multiple passphrases needed to decrypt his various implementations of PGP Whole Disk Encryption and PGP containers. [...] In his final police interview, CTC officers suggested JFL's refusal to decrypt the files or give them his keys would lead to suspicion he was a terrorist or paedophile. And my favourite paragraph: > "There could be child pornography, there could be bomb-making recipes," said one detective. "Unless you tell us we're never gonna know... What is anybody gonna think?" JFL says he maintained his silence because of "the principle - as simple as that". So he was jailed for remaining silent.
  - simonh 13y ago
    He was taken into custody for, among other things: Failing to attend multiple bail hearings; Falsely claiming that a passport that had been legally seized by the police was lost, bearing in mind he'd previous missed bail hearings by traveling abroad; Refusing to comply with lawful requests for access to his computer, etc, etc. There is no '5th Amendment' in the UK, no right of silence and no Miranda rights. There never have been. We do have our own limitations on the rights of police officers conducting an investigation though. If officers have the proper warrants, I think it's reasonable that they are entitled to access to computer records in much the same way they are entitled to access to any other part of someone's property, business and private records. He was willfully obstructive and obtuse, and suffered the consequences for it, but no more than that. The sectioning is of course a matter for concern, but it requires proper medical oversight and bearing in mind his previous history of mental illness there's no particular reason to believe it was malicious.
    - rwmj 13y ago
      Actually there was a Right to Silence, in common law. It was removed by statue in the extremely controversial 1994 Criminal Justice Act (which many of us demonstrated against).
- simonster 13y ago
  Previous HN discussion: https://news.ycombinator.com/item?id=4234614 https://news.ycombinator.com/item?id=4234614
maeon3 13y ago
What is the status of an encryption algorithm that doesn't look like it's encrypted to the spies?
rorrr2 13y ago
It's an awesome weapon. Plant an encrypted file on somebody's computer, report to the police you saw that person was viewing child porn.
- watty 13y ago
  If you're going to do several illegal things to get someone in trouble you might as well just place child porn on their computer...
  - Ygg2 13y ago
    Or put childporn in encrypted format. Just make sure the password is easy to break like 12345.
  - flyinRyan 13y ago
    There are many ways you could legally put an encrypted file on someone else's computer. But if you use actual KP then you're putting yourself at unnecessary risk. Better to have something innocent so if you get caught before you finish your sabotage you can use the key to decrypt the data and show it was innocent.
- gambiting 13y ago
  You don't even need to do that. You can just say that your music files/photos are really encrypted using stenography and you can't prove otherwise. They can't prove they are encrypted either,but I sure they wouldn't bother with such small details.
  - gmac 13y ago
    Same error as in the article, so for clarity/pedantry value: this is steganography (with a ga). Stenography is a fancy word for shorthand.
    - ChuckMcM 13y ago
      and its still encryption, and they can prove that there is information there. A couple projects (one from uMich's CITI lab) showed that you can tell with high certainty when an image has steganographic data added too it.
kintamanimatt 13y ago
It's tempting to think of this as UK-specific issue, but countries like the UK serve as role models. It might be prudent to start campaigning against the most egregious provisions of RIPA.
outworlder 13y ago
This is... interesting. Considering how close UK and US are, it could go like this: raise public awareness about PRISM and the like, prompting people to encrypt their stuff. Now, imprison everyone who has encrypted files. It's like adding a fluorescent agent in a medium to highlight bacteria.
- zalew 13y ago
  You don't imprison everyone, you imprison a few unlucky citizens and the rest is shitting their pants "it could be me". Fighting a population would escalate, targeting single individuals spreads fear as they are just a few people whose case can be manipulated so the public opinion is divided. A difference between how regimes and 'democratic' countries operate.
  - cLeEOGPw 13y ago
    Exactly. Regimes use direct oppression, while democracies use terrorism against people.
wfn 13y ago
In light of this, here's a fun paper/idea (+implementation) to consider: "Neuroscience Meets Cryptography: Designing Crypto Primitives Secure Against Rubber Hose Attacks" https://crypto.stanford.edu/~dabo/pubs/abstracts/rubberhose.html https://crypto.stanford.edu/~dabo/pubs/abstracts/rubberhose.... (summary; full paper (PDF): http://bojinov.org/professional/usenixsec2012-rubberhose.pdf http://bojinov.org/professional/usenixsec2012-rubberhose.pdf) Abstract: "Cryptographic systems often rely on the secrecy of cryptographic keys given to users. Many schemes, however, cannot resist coercion attacks where the user is forcibly asked by an attacker to reveal the key. These attacks, known as rubber hose cryptanalysis, are often the easiest way to defeat cryptography. We present a defense against coercion attacks using the concept of implicit learning from cognitive psychology. Implicit learning refers to learning of patterns without any conscious knowledge of the learned pattern. We use a carefully crafted computer game to plant a secret password in the participant's brain without the participant having any conscious knowledge of the trained password. While the planted secret can be used for authentication, the participant cannot be coerced into revealing it since he or she has no conscious knowledge of it. We performed a number of user studies using Amazon's Mechanical Turk to verify that participants can successfully re-authenticate over time and that they are unable to reconstruct or even recognize short fragments of the planted secret." The scheme/system is bound to be imperfect; but it is a nice angle of approach, so to speak, and hopefully we'll have more stuff of this kind in the near future. edit / P.S.: from the paper / intro section: Readers who want to play with the system can check out the training game at brainauth.com/testdrive
- jwr 13y ago
  It is interesting, but has little to do with the original article, as the police will kindly ask the accused to authenticate, instead of asking for the key.
  - wfn 13y ago
    You are right, when you look at it like that, my comment was a bit of a hijack. The threat model in question assumes that the attackers know that the person in question has a way to auth / is part of an encrypted / limited access system, which is a very sensible assumption (and is included in the police/accused scenario in any case.) I was probably thinking something along the lines of, [this proposed system] + a way for the user to discretely convey to the auth/security system the info that they are being coerced, and the system authenticating them to a bogus user account / set of sensitive data. But this would be cumbersome and very difficult to implement given the design in question, probably. It would have probably been more relevant to mention encryption systems with plausible deniability - e.g. TrueCrypt's hidden volumes [1] and Rubberhose FS [2]. [1]: http://www.truecrypt.org/hiddenvolume http://www.truecrypt.org/hiddenvolume [2]: http://en.wikipedia.org/wiki/Rubberhose_%28file_system%29 http://en.wikipedia.org/wiki/Rubberhose_%28file_system%29
deleted 13y ago
[deleted]
jschneiderhan 13y ago
Would the plausible deniability that comes with using a technique like TrueCrypt's hidden volumes help in a situation like?
- jwr 13y ago
  Any good symmetric encryption algorithm produces data that looks random. You can't tell whether it's just noise or encrypted data. I'd expect a sane judge to treat cases like these as circumstantial evidence — e.g. the police thinks that random data is really encrypted data, but has no proof. From what I know, it is difficult (though not impossible) to land in jail based on circumstantial evidence. I guess if you use encryption tools that add unencrypted metadata headers (as in "this is a file encrypted using AES-256 in CBC mode"), then the evidence is stronger.
  - shabble 13y ago
    Not quite what you're talking about, but there was recently a couple of posts by the 'binwalk' author about differentiating encrypted vs compressed data (presumed header-less): http://www.devttys0.com/2013/06/differentiate-encryption-from-compression-using-math/ http://www.devttys0.com/2013/06/differentiate-encryption-fro... http://www.devttys0.com/2013/06/encryption-vs-compression-part-2/ http://www.devttys0.com/2013/06/encryption-vs-compression-pa...
    - gknoy 13y ago
      Wow! That was really interesting. Thanks for sharing those; have you considered submitting one of them as a story?
      - shabble 13y ago
        The first was submitted a couple of weeks ago at https://news.ycombinator.com/item?id=5871927 https://news.ycombinator.com/item?id=5871927 but didn't seem to take root. Hopefully there'll be a part 3 that gives an excuse to resubmit :)
- 13y ago
Raphmedia 13y ago
Out of the 100+ files and archives I have encrypted, I remember the passwords of about 25 of them. I would so go to jail.
- shabble 13y ago
  likewise. There's quite a lot of valuable data I have encrypted in various blobs that I'd love to get back, but have totally forgotten the passphrase. I keep them around because I hope that one day I'll have an epiphany (or bruteforcing/JtR becomes practical) Bit of a liability though, if I ever come under suspicion of anything. I just can't bear to nuke them though.
CmdrKrool 13y ago
> Regulation of Investigatory Powers Act 2000 Incidentally this is the same law that is also being used to legally justify GCHQ's Tempora operation (the UK's PRISM), according to this Guardian article[1] and discussed on HN previously. [1] http://www.guardian.co.uk/uk/2013/jun/21/gchq-cables-secret-world-communications-nsa http://www.guardian.co.uk/uk/2013/jun/21/gchq-cables-secret-...
burgerz 13y ago
here's what you could do. put an encrypted volume onto somebody's computer. call the cops, tell them he's got child porn on it. they seize his computer, he doesn't know the password. what is the even the fucking point in having a password if the state can just ask you for it?
- jdiez17 13y ago
  Relevant XKCD: http://xkcd.com/538/ http://xkcd.com/538/
- superuser2 13y ago
  There is never under any circumstances in any modern country a situation where you are allowed to "win" a fight against Constitutional and democratically created laws. Asking "what is the point in having a password if the state can just ask you for it" is like asking "what is the point in having a gun if the state can punish me for killing people with it at will?" Encryption is there to protect against thieves, hackers, and other unlawful surveillance. Using encryption isn't ever going to make you impervious to the legal discovery process.
  - burgerz 13y ago
    >"what is the point in having a password if the state can just ask you for it" is like asking "what is the point in having a gun if the state can punish me for killing people with it at will?" no it's not, bad analogy. in the US the state can't put you in jail for not giving a password (remaining silent).
tommorris 13y ago
It gets more interesting than that though. Under the Regulation of Investigatory Powers Act, if you decide to comply and hand over your encryption keys, or to, say, decrypt an email, you are legally obliged to not tell anyone that you have done so. But there is nothing in the law stopping you from saying up front "the only reason I would revoke my encryption key without explanation is if I'm legally obliged to by the cops under the Regulation of Investigatory Powers Act". And when you do so, anyone with a brain can draw the relevant inference...
hahainternet 13y ago
I think it's quite frustrating that apparently nobody in this comment thread bothered to read the relevant laws. It is a sufficient defence in law to state that you do not have access to the key file. The only requirements being that you can show some backing and that the prosecution cannot prove beyond a reasonable doubt that you do have access to it.
- darkarmani 13y ago
  > It is a sufficient defence in law to state that you do not have access to the key file. The only requirements being that you can show some backing and that the prosecution cannot prove beyond a reasonable doubt that you do have access to it. How do you prove you don't have access to a key to data that isn't actually encrypted? Do you need to keep sets of fake keys for sensor data that you lose, so you have a defense?
  - hahainternet 13y ago
    If the data isn't actually encrypted or it is otherwise not protected information then you wouldn't need to provide a specific defence.
    - marcosdumay 13y ago
      Sensor data is indistinguishible from encrypted data. How can some law aplly to one and not be used to the other?
      - gknoy 13y ago
        To elaborate on this: Ideally, encrypted data is indistinguishable from random data, otherwise known as "noise". Sensor data, radio telescope data and so forth often contain lots of that: it's just a LARGE file of bits that seem uncorrelated. No one can prove that a multi-gigabyte file of recorded data contains that, as opposed to them having renamed super-secret.tar.gz to sensor-logs.tar.gz. Since no one can tell the difference, there's a pretty reasonable fear that police could see data related to your hobby (dumping ROMs, analyzing data, etc) and say, "You need to decrypt this so that we can see that it doesn't have $(illegal stuff) in it".
malandrew 13y ago
Why not just keep all your encrypted files stored on a server that is not in the UK jurisdiction? Just SSH in to access your files.

164 points by bougiefever 13y ago

July 13, 2012 A few of us kicked and shouted about this when this was proposed. If you'd like an example of how this is being abused, El Reg has a good article from 2009: http://www.theregister.co.uk/2009/11/24/ripa_jfl/ http://www.theregister.co.uk/2009/11/24/ripa_jfl/

Ygg2 13y ago
So this is one of those laws that everyone broke.
- tehwalrus 13y ago
  nope, it's one of those laws that the police can use on anyone they don't like, anytime. There was a good article of how this "criminalise everyone, and then only prosecute the ones you don't like" attitude was essentially how the US operates by default nowadays - It was on HN a few months ago but I can't find it now.
  - Ygg2 13y ago
    Think that was the point of the laws everyone broke.
    - tehwalrus 13y ago
      apologies if I wasn't clear; there are plenty of laws "still on the statute book" which everyone breaks but which would never be prosecuted. e.g. copying music from CD to iPod before about 2010, or compulsory archery practise with the parish vicar on the village green on Sundays. I was drawing the distinction between that type, which are simply archaic, and this type, which have been designed to incriminate everyone.
- apricot13 13y ago
  there was a chap who had this law used against him a few years back, I don't remember what happened though but it was a big deal at the time. It was to do with encrypting random data for physics or a game or something and the government got hold of it but because the data was encrypted one way he couldn't give them a key and he was going to go to prison for two years. I've heard nothing about it since though with all this PRISM stuff and people encrypting their emails I'm surprised it hasn't resurfaced sooner.
mseebach 13y ago
The case is absolutely awful, but he was jailed for refusing to hand over the key, which is (according to the article) exactly what he did. The article is very kind to the suspect here, and nowhere does it even suggest that he had lost the key or otherwise wasn't able to decrypt the files.
- deleted 13y ago
  [deleted]
- cmircea 13y ago
  Since when is refusing to incriminate oneself punishable with jail time? Last time I checked it wasn't. Refusing to provide encryption keys is the same thing. There might be illegal data, there might not be. It's the duty of the police to prove it, not the accused. Innocent until proven guilty? Not in the UK.
  - lotsofcows 13y ago
    We don't have anti-incrimination laws. If you go in front of a judge, the judge has the right to all relevant information with which to make a decision. What happened here is that the judge asked for the keys and was refused them. Plain and simple. If you don't trust your judicial system to (eventually) get to the right answer, you've got bigger problems.
    - tyrion 13y ago
      "there can be no doubt that the right to remain silent under police questioning and the privilege against self-incrimination are generally recognised international standards which lie at the heart of the notion of a fair procedure" from http://en.wikipedia.org/wiki/Right_to_silence_in_England_and_Wales http://en.wikipedia.org/wiki/Right_to_silence_in_England_and... (and cite-note 15)
      - lotsofcows 13y ago
        It's interesting that the article conflates right to silence and self-incrimination, I thought they were kept separate. It mentions the exception for encryption but doesn't mention any exception for safe codes which is what my line of thinking was based on. That being said, I can't find a reference to that either...
majke 13y ago
Good article! > He returned to Paddington Green station as appointed on 2 December, and was re-arrested for carrying a pocket knife. FTR, carrying a pocket knife is perfectly legal in the UK (assuming it was within a certain size). > Officers bearing sub-machine guns broke down the door of JFL's flat. He rang local police before realising CTC had come for him. [...] JFL maintained his silence throughout the one hour time limit imposed by the notice. He was charged with ten offences under section 53 of RIPA Part III, reflecting the multiple passphrases needed to decrypt his various implementations of PGP Whole Disk Encryption and PGP containers. [...] In his final police interview, CTC officers suggested JFL's refusal to decrypt the files or give them his keys would lead to suspicion he was a terrorist or paedophile. And my favourite paragraph: > "There could be child pornography, there could be bomb-making recipes," said one detective. "Unless you tell us we're never gonna know... What is anybody gonna think?" JFL says he maintained his silence because of "the principle - as simple as that". So he was jailed for remaining silent.
- simonh 13y ago
  He was taken into custody for, among other things: Failing to attend multiple bail hearings; Falsely claiming that a passport that had been legally seized by the police was lost, bearing in mind he'd previous missed bail hearings by traveling abroad; Refusing to comply with lawful requests for access to his computer, etc, etc. There is no '5th Amendment' in the UK, no right of silence and no Miranda rights. There never have been. We do have our own limitations on the rights of police officers conducting an investigation though. If officers have the proper warrants, I think it's reasonable that they are entitled to access to computer records in much the same way they are entitled to access to any other part of someone's property, business and private records. He was willfully obstructive and obtuse, and suffered the consequences for it, but no more than that. The sectioning is of course a matter for concern, but it requires proper medical oversight and bearing in mind his previous history of mental illness there's no particular reason to believe it was malicious.
  - rwmj 13y ago
    Actually there was a Right to Silence, in common law. It was removed by statue in the extremely controversial 1994 Criminal Justice Act (which many of us demonstrated against).
simonster 13y ago
Previous HN discussion: https://news.ycombinator.com/item?id=4234614 https://news.ycombinator.com/item?id=4234614

maeon3 13y ago

What is the status of an encryption algorithm that doesn't look like it's encrypted to the spies?

rorrr2 13y ago

It's an awesome weapon. Plant an encrypted file on somebody's computer, report to the police you saw that person was viewing child porn.

watty 13y ago
If you're going to do several illegal things to get someone in trouble you might as well just place child porn on their computer...
- Ygg2 13y ago
  Or put childporn in encrypted format. Just make sure the password is easy to break like 12345.
- flyinRyan 13y ago
  There are many ways you could legally put an encrypted file on someone else's computer. But if you use actual KP then you're putting yourself at unnecessary risk. Better to have something innocent so if you get caught before you finish your sabotage you can use the key to decrypt the data and show it was innocent.
gambiting 13y ago
You don't even need to do that. You can just say that your music files/photos are really encrypted using stenography and you can't prove otherwise. They can't prove they are encrypted either,but I sure they wouldn't bother with such small details.
- gmac 13y ago
  Same error as in the article, so for clarity/pedantry value: this is steganography (with a ga). Stenography is a fancy word for shorthand.
  - ChuckMcM 13y ago
    and its still encryption, and they can prove that there is information there. A couple projects (one from uMich's CITI lab) showed that you can tell with high certainty when an image has steganographic data added too it.

kintamanimatt 13y ago

It's tempting to think of this as UK-specific issue, but countries like the UK serve as role models. It might be prudent to start campaigning against the most egregious provisions of RIPA.

outworlder 13y ago

This is... interesting. Considering how close UK and US are, it could go like this: raise public awareness about PRISM and the like, prompting people to encrypt their stuff. Now, imprison everyone who has encrypted files. It's like adding a fluorescent agent in a medium to highlight bacteria.

zalew 13y ago
You don't imprison everyone, you imprison a few unlucky citizens and the rest is shitting their pants "it could be me". Fighting a population would escalate, targeting single individuals spreads fear as they are just a few people whose case can be manipulated so the public opinion is divided. A difference between how regimes and 'democratic' countries operate.
- cLeEOGPw 13y ago
  Exactly. Regimes use direct oppression, while democracies use terrorism against people.

wfn 13y ago

In light of this, here's a fun paper/idea (+implementation) to consider: "Neuroscience Meets Cryptography: Designing Crypto Primitives Secure Against Rubber Hose Attacks" https://crypto.stanford.edu/~dabo/pubs/abstracts/rubberhose.html https://crypto.stanford.edu/~dabo/pubs/abstracts/rubberhose.... (summary; full paper (PDF): http://bojinov.org/professional/usenixsec2012-rubberhose.pdf http://bojinov.org/professional/usenixsec2012-rubberhose.pdf) Abstract: "Cryptographic systems often rely on the secrecy of cryptographic keys given to users. Many schemes, however, cannot resist coercion attacks where the user is forcibly asked by an attacker to reveal the key. These attacks, known as rubber hose cryptanalysis, are often the easiest way to defeat cryptography. We present a defense against coercion attacks using the concept of implicit learning from cognitive psychology. Implicit learning refers to learning of patterns without any conscious knowledge of the learned pattern. We use a carefully crafted computer game to plant a secret password in the participant's brain without the participant having any conscious knowledge of the trained password. While the planted secret can be used for authentication, the participant cannot be coerced into revealing it since he or she has no conscious knowledge of it. We performed a number of user studies using Amazon's Mechanical Turk to verify that participants can successfully re-authenticate over time and that they are unable to reconstruct or even recognize short fragments of the planted secret." The scheme/system is bound to be imperfect; but it is a nice angle of approach, so to speak, and hopefully we'll have more stuff of this kind in the near future. edit / P.S.: from the paper / intro section: Readers who want to play with the system can check out the training game at brainauth.com/testdrive

jwr 13y ago
It is interesting, but has little to do with the original article, as the police will kindly ask the accused to authenticate, instead of asking for the key.
- wfn 13y ago
  You are right, when you look at it like that, my comment was a bit of a hijack. The threat model in question assumes that the attackers know that the person in question has a way to auth / is part of an encrypted / limited access system, which is a very sensible assumption (and is included in the police/accused scenario in any case.) I was probably thinking something along the lines of, [this proposed system] + a way for the user to discretely convey to the auth/security system the info that they are being coerced, and the system authenticating them to a bogus user account / set of sensitive data. But this would be cumbersome and very difficult to implement given the design in question, probably. It would have probably been more relevant to mention encryption systems with plausible deniability - e.g. TrueCrypt's hidden volumes [1] and Rubberhose FS [2]. [1]: http://www.truecrypt.org/hiddenvolume http://www.truecrypt.org/hiddenvolume [2]: http://en.wikipedia.org/wiki/Rubberhose_%28file_system%29 http://en.wikipedia.org/wiki/Rubberhose_%28file_system%29

deleted 13y ago

[deleted]

jschneiderhan 13y ago

Would the plausible deniability that comes with using a technique like TrueCrypt's hidden volumes help in a situation like?

jwr 13y ago
Any good symmetric encryption algorithm produces data that looks random. You can't tell whether it's just noise or encrypted data. I'd expect a sane judge to treat cases like these as circumstantial evidence — e.g. the police thinks that random data is really encrypted data, but has no proof. From what I know, it is difficult (though not impossible) to land in jail based on circumstantial evidence. I guess if you use encryption tools that add unencrypted metadata headers (as in "this is a file encrypted using AES-256 in CBC mode"), then the evidence is stronger.
- shabble 13y ago
  Not quite what you're talking about, but there was recently a couple of posts by the 'binwalk' author about differentiating encrypted vs compressed data (presumed header-less): http://www.devttys0.com/2013/06/differentiate-encryption-from-compression-using-math/ http://www.devttys0.com/2013/06/differentiate-encryption-fro... http://www.devttys0.com/2013/06/encryption-vs-compression-part-2/ http://www.devttys0.com/2013/06/encryption-vs-compression-pa...
  - gknoy 13y ago
    Wow! That was really interesting. Thanks for sharing those; have you considered submitting one of them as a story?
    - shabble 13y ago
      The first was submitted a couple of weeks ago at https://news.ycombinator.com/item?id=5871927 https://news.ycombinator.com/item?id=5871927 but didn't seem to take root. Hopefully there'll be a part 3 that gives an excuse to resubmit :)
13y ago

Raphmedia 13y ago

Out of the 100+ files and archives I have encrypted, I remember the passwords of about 25 of them. I would so go to jail.

shabble 13y ago
likewise. There's quite a lot of valuable data I have encrypted in various blobs that I'd love to get back, but have totally forgotten the passphrase. I keep them around because I hope that one day I'll have an epiphany (or bruteforcing/JtR becomes practical) Bit of a liability though, if I ever come under suspicion of anything. I just can't bear to nuke them though.

CmdrKrool 13y ago

> Regulation of Investigatory Powers Act 2000 Incidentally this is the same law that is also being used to legally justify GCHQ's Tempora operation (the UK's PRISM), according to this Guardian article[1] and discussed on HN previously. [1] http://www.guardian.co.uk/uk/2013/jun/21/gchq-cables-secret-world-communications-nsa http://www.guardian.co.uk/uk/2013/jun/21/gchq-cables-secret-...

burgerz 13y ago

here's what you could do. put an encrypted volume onto somebody's computer. call the cops, tell them he's got child porn on it. they seize his computer, he doesn't know the password. what is the even the fucking point in having a password if the state can just ask you for it?

jdiez17 13y ago
Relevant XKCD: http://xkcd.com/538/ http://xkcd.com/538/
superuser2 13y ago
There is never under any circumstances in any modern country a situation where you are allowed to "win" a fight against Constitutional and democratically created laws. Asking "what is the point in having a password if the state can just ask you for it" is like asking "what is the point in having a gun if the state can punish me for killing people with it at will?" Encryption is there to protect against thieves, hackers, and other unlawful surveillance. Using encryption isn't ever going to make you impervious to the legal discovery process.
- burgerz 13y ago
  >"what is the point in having a password if the state can just ask you for it" is like asking "what is the point in having a gun if the state can punish me for killing people with it at will?" no it's not, bad analogy. in the US the state can't put you in jail for not giving a password (remaining silent).

tommorris 13y ago

It gets more interesting than that though. Under the Regulation of Investigatory Powers Act, if you decide to comply and hand over your encryption keys, or to, say, decrypt an email, you are legally obliged to not tell anyone that you have done so. But there is nothing in the law stopping you from saying up front "the only reason I would revoke my encryption key without explanation is if I'm legally obliged to by the cops under the Regulation of Investigatory Powers Act". And when you do so, anyone with a brain can draw the relevant inference...

hahainternet 13y ago

I think it's quite frustrating that apparently nobody in this comment thread bothered to read the relevant laws. It is a sufficient defence in law to state that you do not have access to the key file. The only requirements being that you can show some backing and that the prosecution cannot prove beyond a reasonable doubt that you do have access to it.

darkarmani 13y ago
> It is a sufficient defence in law to state that you do not have access to the key file. The only requirements being that you can show some backing and that the prosecution cannot prove beyond a reasonable doubt that you do have access to it. How do you prove you don't have access to a key to data that isn't actually encrypted? Do you need to keep sets of fake keys for sensor data that you lose, so you have a defense?
- hahainternet 13y ago
  If the data isn't actually encrypted or it is otherwise not protected information then you wouldn't need to provide a specific defence.
  - marcosdumay 13y ago
    Sensor data is indistinguishible from encrypted data. How can some law aplly to one and not be used to the other?
    - gknoy 13y ago
      To elaborate on this: Ideally, encrypted data is indistinguishable from random data, otherwise known as "noise". Sensor data, radio telescope data and so forth often contain lots of that: it's just a LARGE file of bits that seem uncorrelated. No one can prove that a multi-gigabyte file of recorded data contains that, as opposed to them having renamed super-secret.tar.gz to sensor-logs.tar.gz. Since no one can tell the difference, there's a pretty reasonable fear that police could see data related to your hobby (dumping ROMs, analyzing data, etc) and say, "You need to decrypt this so that we can see that it doesn't have $(illegal stuff) in it".

malandrew 13y ago

Why not just keep all your encrypted files stored on a server that is not in the UK jurisdiction? Just SSH in to access your files.