Withold password, go to jail

http://www.theregister.co.uk/2009/08/11/ripa_iii_figures/

by pmikal • 17 years ago

38 38 17 years ago

theregister.co.uk

tptacek2• 17 years ago

Does this surprise anyone? If you're served a warrant, you have to unlock your doors or open your safe, too.

ErrantX4• 17 years ago

As a point of interest. The level of evidence required to get to serve on of these notices is fairly high. I'm willing to bet (an informed guess really) that it is a very small percentage of people with encrypted material that qualify to be served.

nopassrecover• 17 years ago

Australia has had this for a very long time.

Janzert• 17 years ago

To my lay understanding (IANAL) it seems the legal system used to have a strong distinction between "things you have" and "things you know". To the point in the U.S. where "taking the 5th" is very much in the public consciousness as not having to say anything that could be used against you. A warrant certainly can be used to take the drive with any encrypted material on it, but forcing divulgence of the keys seems like another level entirely.

tptacek2• 17 years ago

Same logic says if you have a safe full of papers --- records of things you know --- you can refuse a search warrant for the contents of your safe.

(Yes, that's my point.)

jrockway4• 17 years ago

It is not that clear cut. You don't have to unlock the safe, you have to provide the key to unlock the safe. If the key only exists in your mind, and the contents of your mind are protected by the Fifth Amendment, then it is likely that you don't have to provide the key.

You are further protected by the fact that we don't have mind-reading devices yet. (People are often forgetful under stress, so it follows that you could forget your difficult-to-remember password under the stress of arrest and trial.)

Yes, there is US v. Boucher. That is a very special case, however, and District Court rulings are far from definitive.

evgen• 17 years ago

The "contents of your mind" are not protected by the 5th amendment. The part of the 5th that everyone remembers and obsesses about only prevents the state from compelling you to testify against yourself.

Here is the example which is more appropriate to this discussion: The state contends that Bernie Madoff may have stashed billions in offshore bank accounts, the state has proof that these accounts exist and that he accessed them on a regular basis. The state (specifically a judge) can compel him to produce the account numbers and access codes to enable prosecutors and investigators to examine the account activity. If he refuses the judge has the power to place him in jail (for contempt of court) until such time as he provides the information to the court that it feels is necessary to render a fair judgement.

rdtsc• 17 years ago

What if you forgot your password. O have a file catted from /dev/random that looks like a it could be TrueCrypt partition, good luck trying to convince them it is not an encrypted file. They'll just say "yeah, yeah" and you go to jail for 5 years.

jrockway4• 17 years ago

For what crime?

Despite what you might hear from Fox News, you do actually have the right to a fair trial.

So far the case law (in the US) with respect to crypto is unclear. The only case involved someone showing the government child porn on their computer, and only later not providing the key. As far as I know, having an encrypted partition has never gotten anyone in any trouble, even if accused of a crime.

ErrantX4• 17 years ago

> O have a file catted from /dev/random that looks like a it could be TrueCrypt partition, good luck trying to convince them it is not an encrypted file.

That's a mistake unlikely to be made; partly because the vast majority of seized computers run Windows :P but mostly because it is fairly obvious.

makmanalp• 17 years ago

Actually, the randomness coming from /dev/random and the randomness of a TrueCrypt partition are demonstrably different. See: http://16systems.com/TCHunt/faq.php

pbhjpbhj8• 17 years ago

I have a little more faith in the mathematicians of GCHQ than this. Indeed I suspect that in at least some of these cases (which according to Sir Christoper relate only to child endangerment, domestic abuse or terrorism) GCHQ could decrypt the contents themselves but wished not to reveal that fact to terrorist groups that want to blow us all [in the UK] up.

snprbob86• 17 years ago

Should have used deniable encryption...

http://en.wikipedia.org/wiki/Deniable_encryption

pbhjpbhj8• 17 years ago

Which will work so long as you've used a perfect system that can't be shown to have encrypted data by the boffins of GCHQ. Not a gamble I'd take. Remember if you've claimed there is no encrypted data and so refused to provide a key they'll only need to show that there is encrypted data and possibly that you own that computer (but if you've made the aforesaid denial I don't think they'd even need to do that, logically) - perhaps on seizing the computer an officer caught information displayed on screen on their video camera (used to record during raids) before you hit the power switch. Perhaps there's a snippet of something that can be extracted from a volatile memory buffer?

I don't fancy your chances. So you may as well not bother planning any terror attacks, kthnxbye

simanyay2• 17 years ago

As far as I understand, this law was created to get very important information from really serious criminals. But if a person has materials that may get him into more serious troubles than 5 years jail-time it is in their interest not to provide encryption keys.

Or do I miss something?

weavejester• 17 years ago

Presumably they'd rather put them away for 5 years than let them go free.

pbhjpbhj8• 17 years ago

Perhaps 5 years is the time the UK security services believe is required to crack currently available encryption systems if necessary. So, you plan your truck bombing, get locked up for 5 years for not revealing the decryption keys, then get locked up for "life" for the planned terror acts.

321abc2• 17 years ago

I've been using computers since the 1980's, and have had dozens and dozens of passwords. I honestly don't remember the vast majority of passwords I've used in the past.

Many of the passwords I currently use have been randomly generated and are stored in a password storage app, the database in which these passwords are stored could be easily lost, damaged beyond recovery, or to which I could forget the master password.

So, if legally required to produce a password for some reason, I could quite conceivably go to jail even if I were willing to provide the password, but just couldn't remember what it was (or if it was one of the randomly generated passwords that I'd never memorized in the first place but no longer had access to for some reason).

simanyay2• 17 years ago

I don't think that UK police will get a section 49 notice just to get some random password because I am pretty sure that the NTAC requires a lot of information proving that they are looking for data that may help preventing future illegal actions or something like that.

So I think the police really know what are they looking for when obtaining this warrant.

ErrantX4• 17 years ago

Yes. The form islong and very thorough. No random police person could fill it in - you have to be fairly expert to provide the relevant detail.

chris11• 17 years ago

Yeah, I don't remember all of my passwords either. And I usually have the most trouble remembering my most important passwords, since the number of times I use a password is pretty much inversely correlated to the importance of the data it protects. So the idea that I could be jailed for not admitting something that I no longer had knowledge of is somewhat scary.

pbhjpbhj8• 17 years ago

How about the password for what ever is currently the most important thing in your life? Or not even most important, do you remember your cash-card PIN?

Terrorists planning the London bombings, for example, are unlikely to have forgotten their password. They've memorised the whole Koran (on the whole) remembering the access code to the details of the single most important defining action in their entire lives is unlikely.

Still possible, but I don't think your story is relevant.

rgrieselhuber• 17 years ago

I've always assumed that there was a backdoor into all of the major Crypto algorithms anyways...

sho• 17 years ago

Nah, not on the public, peer-reviewed algorithms. Any breaks are likely to be with implementation details of the program.

Truecrypt et al are open source, and are considered pretty good if set up by someone who knows what they're doing.

There is of course the possibility that The Man puts considerable effort into finding and/or encouraging subtle holes in common encryption products; even if so, though, they would sit on that asset and only use it when seriously important. Ie, military/national security level use, not cops. When you spend millions developing a tiny, secret advantage you do not fritter it away so PC Plod and Sgt Sad Sack can power trip on getting into some pleb's porn folder, after which the hole used is discovered and patched the next day.

update: oh he was downvoted? That's harsh, it's not like there hasn't been any precedent for such things. Search for Crypto AG. And encryption systems as used by programs like Skype are absolutely not to be trusted; you can assume they are backdoored wide enough to drive 10 unmarked white vans and a black helicopter through.

pbhjpbhj8• 17 years ago

The 5 year sentence in the article is for failure to reveal keys in cases concerning national security, ie terrorism.

praptak• 17 years ago

What if I keep a thoroughly smashed memory stick in my drawer (just in case) and testify that:

1. My disk is encrypted with a key stored on the stick.

2. I smashed the stick a week ago (felt paranoid, whatever).

A sort of poor man's deniable encryption.

eru• 17 years ago

Better go with a CD-R, they are far easier to damage than memory sticks.

pbhjpbhj8• 17 years ago

You'd have had to have melted or burnt the CD, IMO. And be ready to be held for purjory (sp?) when the brightest and best computing and mathematical minds of the UK show that you accessed the data that day (or whatever). Or the less bright observations of the stakeout team show you're lying.

Best option: Don't abuse children, commit domestic abuse, or plan terrorist actions - then this law won't be applied.

Withold password, go to jail

Related Stories