Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

UK anti-encryption law

falkvinge.net

Post reply on HN
Print view View original

21–30 of 198 posts

Re: UK anti-encryption law

#21

Post by genwin »

freehunter wrote: post #6

I have to wonder if this would ever hold up in court. I don't know much about the UK justice system, but in America it would be pretty rare to be convicted of a crime that they can't actually prove you committed. You could be jailed for refusing to comply with a court order to decrypt the file, but if you can prove it's not actually encrypted, they can't do anything about it.

In America a suspect can be jailed for years, even in solitary confinement, no conviction or trial required. The actual number of cases may be small but it's still scary.

Re: UK anti-encryption law

#22

Post by nathan_long »

adrianN wrote: post #11
nathan_long wrote: post #4

His argument is: 1) They can lock you up for refusing to decrypt something. 2) Encrypted data looks exactly like random noise. 3) Encrypted data can be hidden in any file. 4) Therefore, they can allege that nearly anything is encrypted and lock you up on that basis. I'd say that's terrifying. Another thought: doesn't this make it possible to frame someone by writing random data to their hard drive?

If you can write data to someone's hard drive it is simpler to just dump some child pornography.

OK, but suppose you're trying to frame them for bank fraud. Coming up with incriminating data is a lot trickier than just making it look like they have something.

Re: UK anti-encryption law

#23

Post by knowaveragejoe »

aqme28 wrote: post #20
nathan_long wrote: post #4

His argument is: 1) They can lock you up for refusing to decrypt something. 2) Encrypted data looks exactly like random noise. 3) Encrypted data can be hidden in any file. 4) Therefore, they can allege that nearly anything is encrypted and lock you up on that basis. I'd say that's terrifying. Another thought: doesn't this make it possible to frame someone by writing random data to their hard drive?

Yes. From the comments (credit to http://www.ktetch.co.uk/p/about-me.html ): "Funny thing about the RIPA act was that in 1999, when the act was first discussed, civil Liberties group Stand decided to show the problem. They sent an email to the Home Secretary (the minister for law and justice) containing a confession (source http://www.zdnet.com/surveillance-straw-petitioned-on-commer... ). That confession was encrypt…

And the reply to that:

"This argument is ridiculous, since it’s missing the concept of intent. The Home Secretary clearly had no intent. That’s why he/she wasn’t charged."

Re: UK anti-encryption law

#24

Post by hemancuso »

adrianN wrote: post #11
nathan_long wrote: post #4

His argument is: 1) They can lock you up for refusing to decrypt something. 2) Encrypted data looks exactly like random noise. 3) Encrypted data can be hidden in any file. 4) Therefore, they can allege that nearly anything is encrypted and lock you up on that basis. I'd say that's terrifying. Another thought: doesn't this make it possible to frame someone by writing random data to their hard drive?

If you can write data to someone's hard drive it is simpler to just dump some child pornography.

I'm a bit disturbed that you suggest it's easier dump child porn onto somebody's hard drive than it is to dump a random bitstream onto the drive. It implies you've got a huge cache of it hanging around ready to go.

Re: UK anti-encryption law

#25

Post by jgeralnik »

nathan_long wrote: post #9
freehunter wrote: post #6

I have to wonder if this would ever hold up in court. I don't know much about the UK justice system, but in America it would be pretty rare to be convicted of a crime that they can't actually prove you committed. You could be jailed for refusing to comply with a court order to decrypt the file, but if you can prove it's not actually encrypted, they can't do anything about it.

>> if you can prove it's not actually encrypted But that's the thing: you can't prove that. You're saying: "prove that there does not exist any decryption method or key that will turn this blob into incriminating data." You can never prove that such a decryption method doesn't exist. In fact, maybe it does exist? Given a blob of random data and infinite time, couldn't you find a way to "decrypt" that into pre-defined…

It's really quite simple. Just xor it with some publicly available text, and then present the result of that xor as the "encryption key". When you xor that result with the original data, you get the publicly available text back.

Re: UK anti-encryption law

#26

Post by nathan_long »

mjhall wrote: post #10
nathan_long wrote: post #4

His argument is: 1) They can lock you up for refusing to decrypt something. 2) Encrypted data looks exactly like random noise. 3) Encrypted data can be hidden in any file. 4) Therefore, they can allege that nearly anything is encrypted and lock you up on that basis. I'd say that's terrifying. Another thought: doesn't this make it possible to frame someone by writing random data to their hard drive?

The argument isn't totally correct. The Police can't just make allegations and force you to surrender keys - they have to convince a judge that the allegations are true, and that getting the keys to your random noise will produce evidence. RIPA is objectively flawed legislation, but it definitely doesn't "outlaw encryption" by anything less than a very long stretch of the imagination (as appears in this article).

>> they have to convince a judge that the allegations are true, and that getting the keys to your random noise will produce evidence

You are correct. However, suppose you encrypt some data and forget the key, or you store some radio noise in a file, or whatever.

Later, you are accused of a crime. The judge issues a warrant.

The data/noise is now evidence against you. You are presumed guilty, and it is impossible to prove your innocence.

Re: UK anti-encryption law

#27

Post by crusso »

adrianN wrote: post #18
nathan_long wrote: post #9

Earlier quoted context omitted.

>> if you can prove it's not actually encrypted But that's the thing: you can't prove that. You're saying: "prove that there does not exist any decryption method or key that will turn this blob into incriminating data." You can never prove that such a decryption method doesn't exist. In fact, maybe it does exist? Given a blob of random data and infinite time, couldn't you find a way to "decrypt" that into pre-defined…

You can decrypt random data to anything if you want to. Say R is your random data and M is the message you want. Compute Key=R+M, then decrypt R-Key=M.

Assuming the encryption method can create the bit sequence that is the random data. It very well might not. There may be gaps in the encrypted data's number space.

For any non-trivial encryption method, you'd be brute forcing your way through a bunch of them to find the key that can decrypt the random noise to that message. Typical "20 times longer than the existence of the universe" warnings apply. :)

Re: UK anti-encryption law

#28

Post by nathan_long »

hemancuso wrote: post #24
adrianN wrote: post #11

Earlier quoted context omitted.

If you can write data to someone's hard drive it is simpler to just dump some child pornography.

I'm a bit disturbed that you suggest it's easier dump child porn onto somebody's hard drive than it is to dump a random bitstream onto the drive. It implies you've got a huge cache of it hanging around ready to go.

Me too. Also, it's not "easier" even if you have it. To dump data, you have to have and transmit data; to dump noise, you just need a tiny script.

Re: UK anti-encryption law

#30

Post by 16s »

It is impossible to prove a PRNG'ed file is or is not encrypted data. TrueCrypt volumes look identical to `dd if=/dev/urandom of=file.bin bs=512`. Create a few of each and then evaluate them using ent to see this for yourself.

Edit: Link to ent http://www.fourmilab.ch/random/

You could prove the file is encrypted if it is indeed encrypted and you have the passphrase and the program to decrypt it, but outside of that, it's simply not possible to say with any level of confidence that the bits are really encrypted.

BTW, I wrote TCHunt in 2007, a program that attempts to seek out encrypted TrueCrypt volumes and I have a FAQ that covers much of this. Here's the link for anyone interested in reading more about it: http://16s.us/TCHunt/

And, there is usually much more to it than randomish bits in a file on a disk. The government agents usually have other evidence that suggests the person in question is doing illegal things and may have cause to use encryption. Finding actual encrypted data is normally just icing on the cake to them.

Post reply on HN