Live data from Hacker News

UK anti-encryption law

falkvinge.net

11–20 of 198 posts

Re: UK anti-encryption law

#11

His argument is: 1) They can lock you up for refusing to decrypt something. 2) Encrypted data looks exactly like random noise. 3) Encrypted data can be hidden in any file. 4) Therefore, they can allege that nearly anything is encrypted and lock you up on that basis. I'd say that's terrifying. Another thought: doesn't this make it possible to frame someone by writing random data to their hard drive?

If you can write data to someone's hard drive it is simpler to just dump some child pornography.

Re: UK anti-encryption law

#12

His argument is: 1) They can lock you up for refusing to decrypt something. 2) Encrypted data looks exactly like random noise. 3) Encrypted data can be hidden in any file. 4) Therefore, they can allege that nearly anything is encrypted and lock you up on that basis. I'd say that's terrifying. Another thought: doesn't this make it possible to frame someone by writing random data to their hard drive?

Well if you find yourself being asked for the encryption key for /dev/rand then you know things are pretty messed up. Given the technology intellegence of some law makers I do wonder when that day will come about.

Re: UK anti-encryption law

#13

I have to wonder if this would ever hold up in court. I don't know much about the UK justice system, but in America it would be pretty rare to be convicted of a crime that they can't actually prove you committed. You could be jailed for refusing to comply with a court order to decrypt the file, but if you can prove it's not actually encrypted, they can't do anything about it.

It's very hard to prove that high-entropy random data isn't encrypted.

Re: UK anti-encryption law

#14

I have to wonder if this would ever hold up in court. I don't know much about the UK justice system, but in America it would be pretty rare to be convicted of a crime that they can't actually prove you committed. You could be jailed for refusing to comply with a court order to decrypt the file, but if you can prove it's not actually encrypted, they can't do anything about it.

[deleted]

Re: UK anti-encryption law

#15

I have to wonder if this would ever hold up in court. I don't know much about the UK justice system, but in America it would be pretty rare to be convicted of a crime that they can't actually prove you committed. You could be jailed for refusing to comply with a court order to decrypt the file, but if you can prove it's not actually encrypted, they can't do anything about it.

The law's been around for quite a long time (since 2000, but it didn't come into force for a while after that). The answer to your question about unproven crime with random data is simply that it hasn't been tested in court yet. When a case comes along where the prosecution is claiming something is encrypted data, and the defendant's side is claiming it's random data, then this will be tested. Until then it's anyone's guess what'll happen.

Re: UK anti-encryption law

#16
post #5

Earlier quoted context omitted.

>> You are then within the law. What good does your maneuver do? Now you have to work with that key, and if they really care, they can laboriously type it in. All you've done is tick them off, right?

Point being that there is a good posibility they will misfile it and in that case you have extingished your liability. Ticking of the police is not against the law and if enough people do it then the sillyness of things starts to stand out. That all said you can have a trusted friend who lives in another counry maintain your key and vice versa, then things get messy. Sad part about all this is criminals will find a w…

This is silly. If they misfile it, they'll ask for it again. If you say "I already gave it to you but you lost it, nyah nyah," they'll find you in contempt of court.

For that matter, if you're in the middle of trial and give them what they asked, but in the most massively inconvenient way you can think of, they'll find you in contempt of court.

Judges are not (usually) stupid.

Re: UK anti-encryption law

#17
In the section of the act mentioned (Regulation of Investigatory Powers Act 2000, part III), two of the defined terms are:

“key”, in relation to any electronic data, means any key, code, password, algorithm or other data the use of which (with or without other keys)—

(a)allows access to the electronic data, or

(b)facilitates the putting of the data into an intelligible form;

-- and --

“protected information” means any electronic data which, without the key to the data—

(a)cannot, or cannot readily, be accessed, or

(b)cannot, or cannot readily, be put into an intelligible form;

http://www.legislation.gov.uk/ukpga/2000/23/part/III

At first, I thought the argument in this article was nonsense. However, whilst I'd hope common sense would prevail, the definitions above seem broad enough that a policeman could make one's life difficult for a while.

Re: UK anti-encryption law

#18

I have to wonder if this would ever hold up in court. I don't know much about the UK justice system, but in America it would be pretty rare to be convicted of a crime that they can't actually prove you committed. You could be jailed for refusing to comply with a court order to decrypt the file, but if you can prove it's not actually encrypted, they can't do anything about it.

>> if you can prove it's not actually encrypted But that's the thing: you can't prove that. You're saying: "prove that there does not exist any decryption method or key that will turn this blob into incriminating data." You can never prove that such a decryption method doesn't exist. In fact, maybe it does exist? Given a blob of random data and infinite time, couldn't you find a way to "decrypt" that into pre-defined…

You can decrypt random data to anything if you want to. Say R is your random data and M is the message you want. Compute Key=R+M, then decrypt R-Key=M.

Re: UK anti-encryption law

#19
post #2

I stand by my argument that you can have a encryption key that is say 2000 characters long. Print it out 1 character per page and submit that in advance at your local police station, getting a receipt. You are then within the law. Now question is - compression can be views as encryption. How does that pan out if you use a non-standard form of compression that does not require a key as the compression formula is the k…

The legal system is not a computer program.

Re: UK anti-encryption law

#20

His argument is: 1) They can lock you up for refusing to decrypt something. 2) Encrypted data looks exactly like random noise. 3) Encrypted data can be hidden in any file. 4) Therefore, they can allege that nearly anything is encrypted and lock you up on that basis. I'd say that's terrifying. Another thought: doesn't this make it possible to frame someone by writing random data to their hard drive?

Yes.

From the comments (credit to http://www.ktetch.co.uk/p/about-me.html):

"Funny thing about the RIPA act was that in 1999, when the act was first discussed, civil Liberties group Stand decided to show the problem.

They sent an email to the Home Secretary (the minister for law and justice) containing a confession (source http://www.zdnet.com/surveillance-straw-petitioned-on-commer... ). That confession was encrypted. Mr Straw had details to a crime in his posession, in an encypted file, and no way to decrypt it. He was, under the letter of the law, refusing to decrypt information relevent to a crime, and should therefore be charged under RIPA.

Guess who wasn’t charged? Yes, the law doesn’t actually apply to you is you’re the Home Secretary. Who knew that those in government consider themselves above the laws they inflict on others."

Post reply on HN