UK Man Jailed For Refusing To Decrypt His Files

from the right-against-self-incrimination dept

Wed, Dec 2nd 2009 1:53am — Mike Masnick

Two years ago, a US judge ruled that a guy with an encrypted hard drive did not have to hand over his encryption key to the police, as it would be a violation of the 5th Amendment (the right not to self-incriminate). The argument there is that the encryption key is a form of "speech." This is quite a reasonable ruling -- but it appears that over in the UK they view encryption keys quite differently. Last year, we wrote about a UK court ruling interpreting the Regulation of Investigatory Powers Act 2000 (RIPA) to mean that people could be required to hand over encryption keys, since encryption keys were not "speech" but an object that could be demanded. Unfortunately, this has now resulted in a schizophrenic man being jailed for refusing to decrypt his files. As many are noting, this seems to be an abuse of law enforcement, as the purpose of the RIPA law was supposed to be about stopping organized crime and terrorism, not dumping the mentally ill in prison.

Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.

Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.

While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.

–The Techdirt Team

Filed Under: crime, decryption, uk

73 Comments

If you liked this post, you may also be interested in...

Reader Comments

Subscribe: RSS

View by: Time | Thread

Anonymous Poster, 2 Dec 2009 @ 2:00am

Oh, Britain. Can you possibly suck as a country more?
[ link to this | view in thread ]
vyvyan, 2 Dec 2009 @ 2:11am

Re:
Very soon some Guy Fawkes will be successful in his plot.God save the queen (ofc with a small q) and her majesty's puppets (MPs)
[ link to this | view in thread ]
tuppance, 2 Dec 2009 @ 2:38am

We can't suck anymore than a country that goes to war with no evidence, or that cons its own people in democratic ballots, or one that restricts the building of places of worship, or one that uses it's own people as hostage to political and military advantage, or one that chooses to destroy its environment to feed its people, or one that chooses to join the nuclear arms race,... Britians not perfect - neither are many others.
[ link to this | view in thread ]
Call me Al, 2 Dec 2009 @ 2:57am

Re:
Except the UK does all that and more.

This ruling doesn't surprise me in the slightest. RIPA and the like have been abused from day one... despite the assurances from the government that there would be adequate oversight to ensure that it is only used for its stated purpose.

Its quite amazing that in merely a decade we have completely thrown out nearly all the civil liberties which we had accrued over the past several hundred years... all in the name of security. Are we more secure? No. Its so beyond a joke that all I feel capable of is wringing my hands in anger.
[ link to this | view in thread ]
david (profile), 2 Dec 2009 @ 3:02am

Re:
"Oh, Britain. Can you possibly suck as a country more?"

Every time this sort of thing happens I used to think "that's it, this is as low as we can go." And then something else happens to prove me wrong. So, sadly, I'm forced to say that yes, we probably can.

"We can't suck anymore than a country that goes to war with no evidence"
Well no, but that's because we also went to war with no evidence.

"...or that cons its own people in democratic ballots,"
My own personal view of recent democratic elections suggests that -obviously, imho- we do that too.

"...or one that restricts the building of places of worship,"
Well, we do have a political party that's trying to pursue the Swiss government's recent outlawing of building minarets.

"...or one that uses it's own people as hostage to political and military advantage,"
I have no idea what you're talking about here.

"...or one that chooses to destroy its environment to feed its people,"
Seriously? America might be the furthest ahead in terms of generating pollution that affects climate, but we're not, per-capita, that far behind.

"...or one that chooses to join the nuclear arms race,"
You're serious? You're not aware of the various nuclear subs, and nuclear missiles available to Britain's armed forces?

"Britians not perfect - neither are many others."
Well, no one is. But I don't think the anonymous poster was trying to suggest that America was perfect (I'm presuming, all the way through, that the anon. poster is from the US), just that we're somehow becoming a nation even less enamoured of civil liberties than we used to be.

Virgin Media's deep-packet inspection, BT and Phorm's use of traffic analysis, various legal companies sending out pre-litigation letters offering onerous settlement terms without proof, but nevertheless claiming accuracy and certainty. RIPA being used as a tool to harass parents of school children to check they're not lying when applying to 'good' schools, tracking down dog-walkers that didn't clean up the dog's faeces (which is certainly offensive, but to use RIPA?), and, of course, our legendary cameras-per-capita surveillance system, and impending ID cards.

You're right: Britain's definitely not perfect; but the target should be to achieve perfection, or its semblance, not to move further from it. Orwell may, or may not, be shocked at the current situation, but I know I'm disgusted by it.
[ link to this | view in thread ]
Anonymous Coward, 2 Dec 2009 @ 3:07am

personally i think encrypted files are like items behind a lock door or in a safe.

cant a warrant be issued to force some1 to give access to his home or safe in order to let the police perform there search?

so my question is what are the consequences to some1 refusing to comply with a search warrant.
[ link to this | view in thread ]
Man, 2 Dec 2009 @ 3:15am

What the big deal
This is no different than the police asking you to open you safe in your house, or asking a company to hand over its accounts. Any thing that you put onto a hard drive that would incriminate you, is no different that writing a letter or taking a photo and putting it in you safe.
[ link to this | view in thread ]
jojo, 2 Dec 2009 @ 3:19am

fear as a political tool
I remember a lecture about WWII that said Hitler's political platform was National Security and fixing the post WWI German Economy. Fear has been a political tool for as long as there have been politicians (and megalomaniacs).
Know your History or it will repeat itself.
If someone tells you the world will end if you don't vote for him, he's probably trying to MANIPULATE YOU.
If you see a megalomaniac on the street, flick boogers at him.

;) enjoy your day.
[ link to this | view in thread ]
Pete Austin, 2 Dec 2009 @ 3:29am

gAq2iOTL6Lie4r1aybah
Just because you're paranoid, doesn't mean they're out to get you, and the police really seem to have made an example of this guy. Arresting him trumped-up charges such as owning a "pocket knife", or having negligible quantities of some chemical on his hands, is insane. Anyway, now you also own some encrypted data, because that's what the subject of my comment is. So you could also be locked up for two years. Better clear out that browser cache. This law has always been an ass.
[ link to this | view in thread ]
Anonymous Coward, 2 Dec 2009 @ 3:42am

Misuse?
Isn't this exactly what the RIPA was supposed to cover? A suspect has been identified that has an unusual relationship with society and is in possession of various materials that he has chosen not to explain. My guess is that if he had cooperated from the start then he would be a free man. Parallels with Timothy McVeigh anyone?
Generally speaking, UK laws associated with firearms, explosives etc. require the demonstration of legal possession and use. In this instance, the presence of minute qualtities of RDX requires explanation as legal possession is very restricted.
The RIPA is misused when it is used to snoop on recycle bin usage or dog fouling.
[ link to this | view in thread ]
vyvyan, 2 Dec 2009 @ 4:11am

Re:
but, he has a right to remain silent. The onus of proving guilt lies on prosecution. You can forcefully enter with a search warrant and check, i.e. in this case brute force his encryption keys, but you can't force defendant to provide evidence for his own prosecution.
[ link to this | view in thread ]
Richard (profile), 2 Dec 2009 @ 4:23am

Re: Misuse?
In this instance, the presence of minute qualtities of RDX requires explanation as legal possession is very restricted.

Read the article properly. The quantities of RDX involved are close enough to the detection threshold of the equipment to be discountable as noise.

Even if not it's most likely that this level of contamination could arise from possessing something that had once been manufactured or stored alongside RDX. For example it's possible that soem model rocket propellants could be manafactured at a factory that also deals with RDX or similar chemicals.

It's EXACTLY the same kind of forensic "evidence" that landed the Birmingham six and the Guildford four unjustly in jail when playing card residues were incorrectly identified as "explosives".
[ link to this | view in thread ]
david (profile), 2 Dec 2009 @ 4:27am

Re: Re:
"you can't force defendant to provide evidence for his own prosecution."
That's the point of this story, that here in the UK, apparently, you can. The problem is that now, if you say 'oops, I forgot the password' there's a chance you can be jailed for refusing to cooperate.

"A suspect has been identified that has an unusual relationship with society and is in possession of various materials that he has chosen not to explain."
He had nine nanograms of RDX on his hands, four more than the usually-dismissed/discounted by forensics, five nanograms. The other items were, according to the Register, encrypted hard drives and thumb drives. What possible danger do they represent? The fact that he remained silent under interview is typical for a schizophrenic -I'm no expert, but have worked extensively with the client group in various mental health settings.

Nothing in the story suggests that he had any reason to volunteer information, and precious little to suggest reason to investigate. Perhaps a positive outcome is that the guy's now recieving treatment, but, under a Section of the Mental Health Act, that's not so different to forced captivity in the jail system.
[ link to this | view in thread ]
Richard (profile), 2 Dec 2009 @ 4:28am

Re: What the big deal
Yes it IS different.
In the physical case the police haver the option of breaking in by force if you refuse.

Companies are positively required to keep accounts so failing to keep them is as bad as not handing them over.

In the encryption case the problem is that there is no viable means of distinguishing between someone who is refusing to decrypt his files and someone who has genuinely forgotten the password, or even someone who has a file that REALLY consists of random numbers and hence cannot be decrypted.

Therefore you are legally requiring someone to do something that may be impossible. Clearly that cannot be right.
[ link to this | view in thread ]
Because plan A failed, 2 Dec 2009 @ 5:00am

Plan B
They could waterboard him until he confesses.
[ link to this | view in thread ]
Anonymous Coward, 2 Dec 2009 @ 5:04am

My encryption keys are 512 and 1025 keys longs and I have them totally committed to memory... the smallest amount of stress, like being arrested, could case me to forget parts of the key.
[ link to this | view in thread ]
Anonymous Coward, 2 Dec 2009 @ 5:21am

Re: Re:
it depends on how you look at secured data. I think the judge got it right looking at it as a locked door in a house, when you have a search warrant. The police have the right to knock the door down or ask for the key. The information inside isn't private, it's part of the search.
[ link to this | view in thread ]
Anonymous Coward, 2 Dec 2009 @ 5:24am

Re: Re: Misuse?
Richard,you need to change brands of tin foil, your hat ain't working.

As one of the Queen's loyal subjects, I am a happy man to know that the legal system takes any potential threat seriously, and works to make sure it isn't real. I wouldn't want them dismissing anything as "background noise", only to have it literally blow up in our faces later. I am very satisfied that the crown is doing it's job. Did you live through the worst of the IRA bombings? Do you remember?
[ link to this | view in thread ]
dehaani (profile), 2 Dec 2009 @ 5:41am

Actual encryption?
Some encryption schemes will produce a file that cannot be distinguished from a corrupt file.

If they cannot prove it's encrypted, then how can they force someone to assist in decryption?

Forget safe and key paradigms. It's all moot when you can create a file full of randomised data for whatever reason and end up in jail for having done do.

UK outlaws random data sets? Whatever next?
[ link to this | view in thread ]
Raymond Walden, 2 Dec 2009 @ 6:15am

keys
Suppose you have a hard drive that is encrypted with evidence that would incriminate you. The act of giving up the key is self incrimation and therefore a 5th amendment aurgument as applies to the United States. I would think the UK would have a similar law or right.

Now I wonder if, here in the United States, the FBI broke your encryption, whether then the information would be admissable in court? Is refusing to give the combination to a safe a 5th amendment aurgument but if you get a search warrent and break the safe then that makes it admissable???

Raymond

Raymond
[ link to this | view in thread ]
Anonymous Coward, 2 Dec 2009 @ 6:42am

I'm in the "this story is crap" crowd. I'm almost always in total agreement with the stories on here, but not this time.

It IS like getting a warrant to open a safe because police suspect something illegal inside. It should only be done with a warrant and not for some fishing expedition. But it's not the same as self incrimination.

If a judge issues a warrant, disobeying the warrant it contempt of court, and courts can throw your ass in jail for it. I'm down with that.
[ link to this | view in thread ]
senshikaze (profile), 2 Dec 2009 @ 6:58am

Re:
Most people see the data as a locked box, but the key is free speech and (in the US) covered by law. They can try to crack the encryption (like breaking into a well built safe) with a warrant, but (again, US) they cannot force you to give up the key since it is speech.
[ link to this | view in thread ]
senshikaze (profile), 2 Dec 2009 @ 7:00am

Re: Re: Re: Misuse?
You must never trust your government.

A government that rules least, rules best.

Once you trust them, then they can walk all over you.

Remember, if you wouldn't trust the people of your government individually, you shouldn't trust the government as a whole.
[ link to this | view in thread ]
Anonymous Coward, 2 Dec 2009 @ 7:01am

Re: What the big deal
Is it? What if the safe contained letters that were written in some form of code? Could the police force you to decifer them for you?
[ link to this | view in thread ]
Hephaestus (profile), 2 Dec 2009 @ 7:03am

Re: Re:
Remember, remember the Fifth of November,
The Gunpowder Treason and Plot,
I see no reason
Why the Gunpowder Treason
Should ever be forgot.
Guy Fawkes, Guy Fawkes, t'was his intent
To blow up the King and Parli'ment.
Three-score barrels of powder below
To prove old England's overthrow;
By God's providence he was catch'd (or by God's mercy*)
With a dark lantern and burning match.
Holloa boys, holloa boys, let the bells ring. (Holla*)
Holloa boys, holloa boys, God save the King!
And what should we do with him? Burn him!
[ link to this | view in thread ]
New Mexico Mark, 2 Dec 2009 @ 7:06am

Re: Actual encryption?
Some encryption software (Truecrypt, at least) allows the user to have a hidden encrypted volume inside a regular encrypted volume. This provides an out if you are forced to reveal your password. Just place some mildly interesting files that any person might want to protect in the visible volume and place the really important stuff in the hidden volume. There is no way to distinguish the hidden volume from normal encrypted "noise" within the first volume.

Of course this doesn't solve the legal issues of forcing users to provide decryption keys in the first place. At the point where there is enough evidence to issue a warrant, a suspect's legal expectations of privacy are reduced.

To use the vault example, what if I owned a vault that was impenetrable by any known method, yet I could easily open it with my retinal print? If enough evidence has been provided to issue a warrant, I am hardly incriminating myself by opening the vault any more than I'm incriminating myself by opening my front door. Refusing to do so (just like refusing to allow a home search when presented with a valid warrant) may result in other legal penalties. If my refusal is due to a mental aberration, there still may be undesirable results.

To me the biggest legal issue we face is not forcing people to decrypt data, but doing it based on flimsy (or non-existent) evidence of wrongdoing -- the "you are hiding something from me, therefore you must be guilty of something" accusation. It seems there should be higher levels of legal protection where privacy is deeply invaded, just as there are higher levels of protection against a strip / body cavity search.

If you think we face some thorny legal issues now, what will happen if/when artificial and natural memory are integrated? If it is from something artificial inside my body, can I be forced to provide the stored contents as evidence? Will there be a way to distinguish between natural and augmented memory function? That will certainly test laws against self-incrimination!
[ link to this | view in thread ]
Hephaestus (profile), 2 Dec 2009 @ 7:16am

Re: gAq2iOTL6Lie4r1aybah
"nine nanograms of RDX" ... wow!! nine billionths of a gram of explosives ... bacteria beware!! thats enough RDX to cause you to loose a flagellum !!
[ link to this | view in thread ]
Anonymous Coward, 2 Dec 2009 @ 7:22am

Re: Re:
As an American it really pains me to see Britain getting mud constantly slung at it for this stuff. While it might be quite amusing to poke fun at your funny teeth and you guys make fun of our pudginess and big cars to fit our fat selves... to see a fellow western country that should be part of the "Civil Liberties and protect the people!" just get eroded away like this helps no Western country at all.
[ link to this | view in thread ]
McBeese, 2 Dec 2009 @ 7:24am

Britain has more experience
Fortunately for Americans, Britain has a lot more experience with homeland terrorism than we do here in the US.

Under normal circumstances, you don't see groups of UK police armed with machine guns at the entrance to the airports and behind some of the ticket counters. Under some threat conditions, you do.

Similarly, under some homeland threat conditions, I would be happy for law enforcement to have the right to examine my encrypted data, just like they have the right to search my safe, my safety deposit box, etc.. Why should the digital nature of the goods make them exempt from existing laws? If I put a voice recognition lock on my safe, does that make it exempt from search under the 5th amendment?

Having said that, I can imagine that the RIAA and MPAA will work hard to justify why copyright infringement is a threat to homeland security.
[ link to this | view in thread ]
chris (profile), 2 Dec 2009 @ 7:27am

Re: fear as a political tool
word. the illuminati and the new world order are trying to enslave us all for their robot alien overlord xenu.
[ link to this | view in thread ]
Kai McCarthy, 2 Dec 2009 @ 7:29am

@vyvyan

>but, he has a right to remain silent
[ link to this | view in thread ]
Brad Morrison, 2 Dec 2009 @ 7:41am

Re: Plan B
Brilliant, on several levels:

* the waterboarding or other torture would likely chase the logic required to recall the encryption key(s)

* as vyvan pointed out, in the US the man has the right to remain silent, but--where is it that the guarantee of rights is honored? I've had mine violated by the foolish and the wicked, with no recourse

* how do we know he was not waterboarded? Perhaps he's being dunked even now
[ link to this | view in thread ]
The Groove Tiger (profile), 2 Dec 2009 @ 7:50am

It's not like the UK has ever done anything wrong, like following the wrong suspect to a train and shot him in the head and chest repeatedly to make sure he was dead, because some other guy that dressed completely different with no resemblance whatsoever may or may not have been part of some bombings, and then said to their mother "though luck ma'am, we're doing our job" and refused any kind of responsibility.
[ link to this | view in thread ]
Nicholas Overstreet (profile), 2 Dec 2009 @ 7:55am

haha, wow, lots of tin foil in here.
[ link to this | view in thread ]
John Fenderson (profile), 2 Dec 2009 @ 8:25am

Re: Re: Re:
As an American, I am even more shamed that we do very nearly all of the stuff Britain is doing, but we are better at keeping it quiet and what little does get publicized is met with a general shrug rather than outrage.
[ link to this | view in thread ]
Anonymous Coward, 2 Dec 2009 @ 8:42am

Re: Re:
but, he has a right to remain silent

that is where we disagree DATA is physical record of something it could have been speech in the case of audio files.

but once its recorded its its no longer speech.

i think data should be viewed as printed documents, recordings (CDS OR TAPES) or pictures.
[ link to this | view in thread ]
btr1701 (profile), 2 Dec 2009 @ 9:07am

Re: Warrants
> cant a warrant be issued to force some1 to give access to his
> home or safe in order to let the police perform there search?

No.

The police can get a warrant to open the safe themselves-- either by drilling off the lock or by some other method-- but they can't get a warrant that compels the owner of the safe to provide combination under threat of imprisonment.

Likewise, with encrypted files, the police are free to try to crack them but they can't force someone to provide the decryption keys-- at least in the USA, anyway. The problem with encrypted files versus a safe is that it's relatively simple for the authorities to break into any safe. With robust encryption, even the NSA has trouble cracking it.

In any event, it's simple to get around a requirement like the one in the UK: just say you forgot the key. "I'm sorry officer, I encrypted that drive months ago and haven't used it since because I lost the key myself. I'd love to cooperate but I can't even remember what the key is and I never wrote it down."
[ link to this | view in thread ]
btr1701 (profile), 2 Dec 2009 @ 9:11am

Re: Re: Re:
> The police have the right to knock the door down or ask for the key.

Then let them knock the door down. Even with a physical door, the cops can't throw you in jail for refusing to provide a key to open it just because they have a warrant. They can kick it in, but they can't throw you in the clink because you didn't happen to have the keys with you when they wanted into your house.

No one's saying they can't "knock the door down" with encrypted files, which means a brute force attempt to decrypt them. They just can't (at least in America) force you to open the files for them.
[ link to this | view in thread ]
btr1701 (profile), 2 Dec 2009 @ 9:23am

Re: What the big deal
> This is no different than the police asking you to open you
> safe in your house

If the police arrive at your home with a warrant and tell you to open your safe, and inside they find a piece of paper with the following text written on it:

EMUFPHZLRFAXYUSDJKZLDKRNSHGNFIVJ
YQTQUXQBQVYUVLLTREVJYQTMKYRDMFD
VFPJUDEEHZWETZYVGWHKKQETGF QJNCE
GGWHKK?DQMCPFQZDQMMIAGPFXHQRLG
TIMVMZJANQLVKQEDAGDVFRPJUNGEUNA
QZGZLECGYUXUEENJTBJLBQCRTBJD FHRR
YIZETKZEMVDUFKSJHKFWHKUWQLSZFTI
HHDDDUVH?DWKBFUFPWNTDFIYCUQZERE
EVLDKFEZMOQQJLTTUGSYQPFEUNLA VIDX
FLGGTEZ?FKZBSFDQVGOGIPUFXHHDRKF
FHQNTGPUAECNUVPDJMQCLQUMUNEDFQ
ELZZVRRGKFFVOEEXBDMVPNFQXEZLG RE
DNQFMPNZGLFLPMRJQYALMGNUVPDXVKP
DQUMEBEDMHDAFMJGZNUPLGEWJLLAETG

Can they force you to tell them what it means under threat of imprisonment?

What if you can't?
[ link to this | view in thread ]
btr1701 (profile), 2 Dec 2009 @ 9:27am

Re: Misuse?
> A suspect has been identified that has an unusual relationship
> with society and is in possession of various materials that he
> has chosen not to explain.

Well, I can't speak for the UK but in America we're not required to maintain a "relationship with society" based on what some government bureaucrat thinks is appropriate. Nor are we legally required to explain to the government why we own "various materials", so long as those materials are not illegal to possess.
[ link to this | view in thread ]
btr1701 (profile), 2 Dec 2009 @ 9:29am

Re: Re: Re: Misuse?
> As one of the Queen's loyal subjects

And there's the fundamental difference between you Brits and us Americans. We're not subject to our government. Our government is subject to us.
[ link to this | view in thread ]
btr1701 (profile), 2 Dec 2009 @ 9:40am

Re: Actual encryption?
> Some encryption schemes will produce a file that cannot be
> distinguished from a corrupt file.

And some encryption software provides a contingency key that will forever wipe or scramble the contents, just for this reason.

The police demand you give them the decryption key, so you provide them with the "suicide" key and when they try it, the file disappears or is hopelessly corrupted. And the beauty is, they won't be able to prove why-- it could just as easily be operator error on their part.

Better yet, you leave the suicide key written down somewhere in your place where it's easily discoverable by cops conducting a search, then they won't even bother asking you for the key. They'll just try the one they found on their own, which further removes you from liability when the key erases the files.
[ link to this | view in thread ]
SteveD (profile), 2 Dec 2009 @ 10:55am

Re: Re: What the big deal
"Can they force you to tell them what it means under threat of imprisonment?

What if you can't?"

They can ask you to tell them what it means under threat of 'contempt of court', not imprisonment. If you can neither explain what it says, what it is or how it got there, then it is perfectly reasonable for them to presume you are being uncooperative.

On the wider issue, I'd dispute Mikes (unfortunately unsupported) assertion that: 'The argument there is that the encryption key is a form of "speech." This is quite a reasonable ruling'.

How do encryption keys bare any resemblance to 'speech'? Just because something is stored digitally rather then physically does not fundamentally alter its nature, or the laws involved. Trying to argue a key only exists in the mind of its creator sounds a lot like trying to argue falling tree's only make noise when there is someone to hear them.

If I refuse access to my home (say for example because I had plans for explosive devices hidden there), I'd get contempt of court. But if I refused access to my computer files via encryption (because I had digital plans of explosive devices), that's okay because I have 'the right not to incriminate myself'?

How is that anything but a double-standard? If anything I'd say the American ruling was overly libertarian.

(And speaking of American double-standards, perhaps a few of your yank readers should consider Patriot Act's, posthumously-legalised warrantless wiretapping and random laptop border searches before they start slagging off the UK.)
[ link to this | view in thread ]
nasch (profile), 2 Dec 2009 @ 11:50am

Re: Re: Re:
And if they were printed documents written in code, do you think the government should be able to compel him to tell the police how to decode them? The storage medium is really irrelevant. I would say the police can look at the papers (electronic files) all they want, but he should not have to provide the means to make sense of them. Unfortunately the UK court disagrees.
[ link to this | view in thread ]
nasch (profile), 2 Dec 2009 @ 12:00pm

Re: Re: Re: What the big deal
They can ask you to tell them what it means under threat of 'contempt of court', not imprisonment. If you can neither explain what it says, what it is or how it got there, then it is perfectly reasonable for them to presume you are being uncooperative.

If you're referring to the UK, you may be right, I have no idea. In the US, this is not true. The 5th Amendment to the Constitution states "No person... shall be compelled in any criminal case to be a witness against himself". They can certainly presume you're being uncooperative, but your lack of cooperation would be Constitutionally protected.

Trying to argue a key only exists in the mind of its creator sounds a lot like trying to argue falling tree's only make noise when there is someone to hear them.

What if it actually does exist only in the mind of its creator? That is certainly the only place my encryption key exists.

If I refuse access to my home (say for example because I had plans for explosive devices hidden there), I'd get contempt of court.

If you actively tried to keep them out when they have a warrant, probably. If you just don't let them in, the consequence is they break down the door and execute the warrant.

But if I refused access to my computer files via encryption (because I had digital plans of explosive devices), that's okay because I have 'the right not to incriminate myself'?

He didn't refuse access to the files. The police have the files. He just refused to tell* them the decryption key.

How is that anything but a double-standard? If anything I'd say the American ruling was overly libertarian.

It's difficult to imagine a ruling being *too* protective of individual rights. Possible maybe, but difficult.

(And speaking of American double-standards, perhaps a few of your yank readers should consider Patriot Act's, posthumously-legalised warrantless wiretapping and random laptop border searches before they start slagging off the UK.)

The UK has some terrible abridgements of civil liberties. So does the US. Is that better? :-)

* sounds like speech, doesn't it?
[ link to this | view in thread ]
nasch (profile), 2 Dec 2009 @ 12:08pm

Re: Britain has more experience
Similarly, under some homeland threat conditions, I would be happy for law enforcement to have the right to examine my encrypted data, just like they have the right to search my safe, my safety deposit box, etc.. Why should the digital nature of the goods make them exempt from existing laws?

Um, the existing laws say they cannot search your stuff without a warrant. It's a little scary that you seem to think they can search whatever they want if we're under "homeland threat conditions". Especially because since 9/11 the US is always considered (by our government at least) to be under threat.
[ link to this | view in thread ]
nasch (profile), 2 Dec 2009 @ 12:10pm

Re:
haha, wow, lots of tin foil in here.

I think it's sad when praising and defending the 5th Amendment (which I know doesn't apply in this case) is considered tin foil haberdashery.
[ link to this | view in thread ]
btr1701 (profile), 2 Dec 2009 @ 12:13pm

Re: Re: Re: What the big deal
> If you can neither explain what it says

Funny, 'cause that particular code is part of the Kryptos sculpture, which has yet to be broken even by the world's top cryptographers, using the the most powerful computers. If the NSA can't tell you what it means, how can some court legally require you to do so?

> then it is perfectly reasonable for them to presume you are being
> uncooperative

That's fine. In America, I'm under no obligation to help the police build a case against me. It's actually a fundamental right. So they can presume all they want.

> If I refuse access to my home (say for example because I had
> plans for explosive devices hidden there), I'd get contempt of court.

No, assuming the police had a warrant, you'd just be pushed aside while they searched anyway. It's unlikely you'd be charged with anything. If anything the charge would be obstruction. And if the police didn't have a warrant, then you're perfectly within your rights to refuse access.
[ link to this | view in thread ]
Anonymous Coward, 2 Dec 2009 @ 12:28pm

First the "it's a form of speech" argument is rather weak, but I agree with Mikes point.

-others are comparing the decryption key to a key to a safe.

being forced to provide the decryption key is much more similar to being told to tell the police every thought you've ever had or go to jail.

Inside a safe, you can hide dangerous or illegal objects, on a hard drive, you can only store data, so a sufficiently dedicated person could memorize a large quantity of data.

Could the police force them to tell them that?

1984 may have long come and gone, but maybe Orwell just got the century wrong.
[ link to this | view in thread ]
vivaelamor (profile), 2 Dec 2009 @ 12:58pm

Missed points.
Aside from the freedom of speech and against incriminating oneself issues consider this quote from the article:
"There could be child pornography, there could be bomb-making recipes," said one detective.
They were on a fishing expedition. In America the police are required to be specific about the purpose of their searches under the fourth amendment. In the UK you can read all about the powers of the police in relation to searches on Adviceguide. The general gist of the law is that the police are supposed to have some idea of what they are searching for and what crime it pertains to. In this case the judgement about what constitutes reasonable grounds was a patently bad one, because it is refuted by quotes from the police themselves. The spirit of the law as I understand it is supposed to be that acting like a criminal isn't enough to warrant invasion of privacy, there should be some prior evidence that a crime has been committed or will be committed. In this case, they not only don't know the nature of the crime they want evidence for but the possible explanations they have are completely unrelated.

I had thought that traditionally the rights of the individual were put to be more important than the process of law enforcement with a high bar set for the importance of the crime to exceed the importance of a persons rights. Not having any evidence that a crime had been committed or was going to be committed, how do you argue that there was any grounds to infringe on his right to privacy if you have no idea whether he was guilty of bomb making or possessing child pornography or completely innocent?

Issues of the seemingly absurdly low bar they are using for reasonable grounds aside; Using contempt of court to punish someone who they admit isn't actually suspected of doing anything for exercising their right to privacy is scary. Put in his position I think I would have done similar with the exception that I would use the time in prison to write a book about the issue and capitalise on the publicity from the case to try and spin the situation around to expose the absurdity of it.
[ link to this | view in thread ]
SteveD (profile), 2 Dec 2009 @ 1:05pm

Re: Re: Re: Re: What the big deal
"Funny, 'cause that particular code is part of the Kryptos sculpture, which has yet to be broken even by the world's top cryptographers, using the the most powerful computers. If the NSA can't tell you what it means, how can some court legally require you to do so?"

Hardly much of a 'gotcha' argument, is it? You can explain exactly where it came from and why you can't decode it, along with externally verified sources. That's nothing like refusing to cooperate.

"That's fine. In America, I'm under no obligation to help the police build a case against me. It's actually a fundamental right. So they can presume all they want."

And in Nigeria the police would probably just beat you with sticks, but that's hardly relevant is it? Try to keep your argument within the bounds of the relevant legal framework.

"No, assuming the police had a warrant, you'd just be pushed aside while they searched anyway. It's unlikely you'd be charged with anything. If anything the charge would be obstruction. And if the police didn't have a warrant, then you're perfectly within your rights to refuse access."

Again, your using the wrong legal framework. Contempt of Court is issued for attempting to refuse a search warrant, regardless of if they enter the property or not. Refusing a search without a warrant is irrelevant because it would be breaking-and-entering on their part.
[ link to this | view in thread ]
Anonymous Coward, 2 Dec 2009 @ 2:23pm

The correct headline is:

UK man Jailed for failing to follow a court order

The rest of it is just sensationalist crowing, another attempt at creating moral outrage from Mike.
[ link to this | view in thread ]
Anonymous Coward, 2 Dec 2009 @ 6:47pm

Re: Re: Re:
it depends on how you look at secured data. I think the judge got it right looking at it as a locked door in a house, when you have a search warrant. The police have the right to knock the door down or ask for the key. The information inside isn't private, it's part of the search.

Well, they've got got the data, they just don't know how to interpret it. They're throwing the guy in jail for not helping them do so.
[ link to this | view in thread ]
Anonymous Coward, 2 Dec 2009 @ 6:50pm

Re: Re: Warrants
In any event, it's simple to get around a requirement like the one in the UK: just say you forgot the key. "I'm sorry officer, I encrypted that drive months ago and haven't used it since because I lost the key myself. I'd love to cooperate but I can't even remember what the key is and I never wrote it down."

It is my understand that such a claim of having forgotten the key is no defense in the UK.
[ link to this | view in thread ]
thornintheside, 2 Dec 2009 @ 7:33pm

not a surprise
The UK is quickly headed to a society as depicted in V for Vendetta. Don't want to have thought police cameras in your house? Are you a terrorist? You have encrypted files? Are you a terrorist? Question the government? You are a terrorist. The people in the UK seem to be happy with putting in place laws that one would see had Germany won the war.
[ link to this | view in thread ]
Anonymous Coward, 2 Dec 2009 @ 9:35pm

Re: Misuse?
In this instance, the presence of minute qualtities of RDX requires explanation as legal possession is very restricted.

The amount on his hand could have easily gotten there by him touching a doorknob that was touched by someone else who had touched another doorknob that had been touched by someone else with contaminated hands. So if that happened to you, just exactly how would you explain it? Are you a terrorist?
[ link to this | view in thread ]
Anonymous Coward, 2 Dec 2009 @ 9:51pm

Re: Re: Actual encryption?
And some encryption software provides a contingency key that will forever wipe or scramble the contents, just for this reason.

Care to name such a software? That would be a stupid feature that would only be effective against a stupid attacker. Forensic experts will make copies of the disk first and then work from the copies. That also lets them keep the original as unaltered evidence.

The rest of your scenario is is just silly for that reason.
[ link to this | view in thread ]
Anonymous Coward, 2 Dec 2009 @ 10:08pm

Re:
It IS like getting a warrant to open a safe because police suspect something illegal inside.

No, they have the file and full access to it. They just don't understand it and they're trying to force the suspect to explain it to them. It's like having any other piece of evidence and then demanding that the subject explain the meaning of the evidence and throwing them into jail if they don't.
[ link to this | view in thread ]
Anonymous Coward, 2 Dec 2009 @ 10:15pm

Re: Missed points.
I had thought that traditionally the rights of the individual were put to be more important than the process of law enforcement...

If they aren't then they cease to be rights.
[ link to this | view in thread ]
Anonymous Coward, 2 Dec 2009 @ 10:16pm

The people in the UK seem to be happy with putting in place laws that one would see had Germany won the war.

Maybe we should have just let the Nazis have them.
[ link to this | view in thread ]
Anonymous Coward, 3 Dec 2009 @ 1:33am

Re: Re: Misuse?
This is called "evidence" and the continuation to prosecute is based on gathering enough evidence to secure a conviction based on a trial by jury.
In isolation, a quantity of explosive measured in microgrammes is unlikely to be a problem but it will be investigated. If you are in a position where you are already suspected of something else (as this guy was) then you will end up doing a lot more explaining.
It's also worth pointing out that RDX is a military grade explosive with only specialised commercial uses. I doubt that (even in America) you can trot off down to your local store and buy it.
[ link to this | view in thread ]
btr1701 (profile), 3 Dec 2009 @ 3:50am

Re: Re: Re: Warrants
> It is my understand that such a claim of having forgotten the
> key is no defense in the UK.

If they're imprisoning you for failing to do something you cannot do, then the state has truly become fascist.
[ link to this | view in thread ]
btr1701 (profile), 3 Dec 2009 @ 3:53am

Re: Re: Re: Re: Re: What the big deal
> You can explain exactly where it came from and why you can't
> decode it, along with externally verified sources.

What if you can't? What if you don't know?

> Try to keep your argument within the bounds of the relevant
> legal framework.

Don't know if you've noticed, chief, but this discussion has moved beyond just the UK. At least half this thread is addressing the situation in the USA as well, with people criticizing the judge's ruling that encryption keys are protected by the 5th Amendment.

> Again, your using the wrong legal framework.

Again, no I'm not. I'm participating in the broader discussion here.
[ link to this | view in thread ]
btr1701 (profile), 3 Dec 2009 @ 3:55am

Re: Re: Re: Actual encryption?
> Forensic experts will make copies of the disk first and then
> work from the copies. That also lets them keep the original as
> unaltered evidence.

Funny how the forensic experts for ICE in the Boucher case cited in the article didn't do that...
[ link to this | view in thread ]
The eejit (profile), 3 Dec 2009 @ 5:30am

The main issue, as I see it, is that this a a very bad case of unintended consquences from a very bad ly written law.

RIPA was MEANT for use in counter-terrorism. This man was suspected of being either a terrorist or a drug-maker. I'm not defending the law here, what I'm arguing is that the circumstances made people suspicious and his refusal to self-'incriminate' were more protests.

What staggered me more was that the prosecution case made no mention of his schizophrenia, which would make it far more difficult to recall all the keys required.

Now an interesting legal debate would be 'What if your commercial encryption had the erase failsafe, and you gave the police THAT key instead of the correct key when demanded?'
[ link to this | view in thread ]
RobShaver, 3 Dec 2009 @ 1:40pm

If due process was observed ...
If the police show up at your office with a legally obtained subpoena for your records, can you refuse to turn over the key to your filing cabinet? Well, maybe you don't have to tell them where the key is but they can look for it or cut the cabinet open.

So you're saying an encryption key is protected speech, but a metal key isn't, right?

However, I'm getting really tired of you playing the "schizophrenic" card, as if that makes some difference. Just because he's schizophrenic doesn't mean he's not a member of organize crime, now does it.
[ link to this | view in thread ]
Anonymous Coward, 3 Dec 2009 @ 4:32pm

Re: Re: Re: Re: Actual encryption?
Funny how the forensic experts for ICE in the Boucher case cited in the article didn't do that...

Funny how you call the customs agents "forensic experts" when they weren't. But wait, you're a fed and you guys consider yourselves "experts" at everything, huh? Well I've got news for you, that case was a classic example of you guys screwing up an investigation because you didn't know what you were doing.
[ link to this | view in thread ]
Jez Hemming, 4 Dec 2009 @ 2:34am

RE: Rights of the individual
This government has continually and consistently devalued the rights and more importantly the privacy and legal protection we have previously enjoyed.
Each bit of creeping legislation has taken away another little bit of our personal space, so that now we can neither walk down the street, surf the web or talk to our family without being spied upon.
We are led to a position where any of us could make a genuine mistake and the assumption is guilt.
The changes in our legal system now mean we are actually more often then not compelled to prove our innocence rather than be proven guilty.
Someone above said that our government works for us. I disagree. They are in charge and take every opportuntiy to show us.
It really is time people voted outside the normal parties and shook the buggers up so we could recapture some of our personal and private space.
I still wouldn't want to live in crazy USA though, where guns are normal, law suits ten-a-penny and the Patriot Act is still in force.
We should ally ourselves closer to mainland Europe, where civil liberties are a sanctity few governments dare mess with.
[ link to this | view in thread ]
btr1701 (profile), 4 Dec 2009 @ 10:58am

Re: Re: Re: Re: Re: Actual encryption?
> that case was a classic example of you guys
> screwing up an investigation because you didn't
> know what you were doing.

I don't work for ICE.

But nevertheless, the Boucher case is a prime example of how having a secondary "suicide" key generated could come in handy from a defendant's perspective.

The assertion that the authorities will always make and work from a backup copy is demonstrably false, as the Boucher case handily illustrates.
[ link to this | view in thread ]
btr1701 (profile), 4 Dec 2009 @ 11:04am

Re: RE: Rights of the individual
> that case was a classic example of you guys
> screwing up an investigation because you didn't
> know what you were doing.

Oh, please. "Mainland Europe" routinely violates civil liberties in favor of the state or big-money interests all the time.

They throw you in jail for mimicking a Nazi salute. (Free speech? Not hardly.) They're criminally prosecuting employees of Google for videos that the people involved neither knew about nor endorsed. You can be arrested just for "offending" people.

I could go on and on. The idea that mainland Europe is some bastion of respect for civl liberty is ridiculous.
[ link to this | view in thread ]
Anonymous Coward, 4 Dec 2009 @ 2:07pm

Re: Re: Re: Re: Re: Re: Actual encryption?
The assertion that the authorities will always make and work from a backup copy is demonstrably false, as the Boucher case handily illustrates.

No one made that assertion, either. The assertion was that forensic experts do so. There's not much telling what some idiot who doesn't know what they're doing might do.
[ link to this | view in thread ]
btr1701 (profile), 7 Dec 2009 @ 8:54pm

Re: Re: Re: Re: Re: Re: Re: Actual encryption?
> The assertion was that forensic experts do so.

Which only helps when forensic experts are working the case. As the Boucher case illustrates, that's not always the case, so suicide keys can be handy from a defendant's perspective.
[ link to this | view in thread ]
jack, 12 Aug 2010 @ 12:58pm

3 points
There are 3 types of keys in this discussion:

1) the decryption key for the encrypted file (the subject of this article)
2) the physical key that a police can ask for in a warrant
3) your person mental 'key' that says, i don't have to tell you things that will incriminate myself.

The US judge has said that #1 and #3 are the same, while the UK authorities have said that #1 and #2 are the same.

If you value that digital free speech or expression is an extension of individual, verbal free speech/expression, then you would not need to release the means of controlling that content.

i personally side with #1 and #3 being the same, because to think, and to write, and to digitally keep personal records of your thoughts to yourself is a great counterweight to government tyranny and abuses.

JS
p.s. it's not a coincidence that Orwell's 1984 was predictaed on the UK.
[ link to this | view in thread ]