Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

UK anti-encryption law

falkvinge.net

Post reply on HN
Print view View original

61–70 of 198 posts

Re: UK anti-encryption law

#61

Post by CWuestefeld »

mjhall wrote: post #10
nathan_long wrote: post #4

His argument is: 1) They can lock you up for refusing to decrypt something. 2) Encrypted data looks exactly like random noise. 3) Encrypted data can be hidden in any file. 4) Therefore, they can allege that nearly anything is encrypted and lock you up on that basis. I'd say that's terrifying. Another thought: doesn't this make it possible to frame someone by writing random data to their hard drive?

The argument isn't totally correct. The Police can't just make allegations and force you to surrender keys - they have to convince a judge that the allegations are true, and that getting the keys to your random noise will produce evidence. RIPA is objectively flawed legislation, but it definitely doesn't "outlaw encryption" by anything less than a very long stretch of the imagination (as appears in this article).

Your point is usually true, when the system is working as intended.

But it's not all that unusual for the gov't to really "have it in" for someone, but not be able to pin the crime on them, as with Al Capone.

In his case, the government didn't think it could pin the true charges on him, so he was actually convicted on tax charges. The tax code is big, obscure, and no expert agrees on the detailed interpretation, so it's not too hard to find some technicality that will convict anyone.

This encryption thing could easily be misused the same way: they can't prove you're a bad guy, so they trump up some technicality charges just to get you locked up.

Re: UK anti-encryption law

#62

Post by crusso »

jgeralnik wrote: post #54
crusso wrote: post #27

Earlier quoted context omitted.

Assuming the encryption method can create the bit sequence that is the random data. It very well might not. There may be gaps in the encrypted data's number space. For any non-trivial encryption method, you'd be brute forcing your way through a bunch of them to find the key that can decrypt the random noise to that message. Typical "20 times longer than the existence of the universe" warnings apply. :)

But the encryption method doesn't need to be non-trivial, especially when you define key as anything that (a)allows access to the electronic data, or (b)facilitates the putting of the data into an intelligible form;

So, if you have a meg of random data, you're thinking you could give them a one meg XOR key that decodes it to an MP3 file of "God Save the Queen"?

Okay. :)

Re: UK anti-encryption law

#63

Post by try-finally »

jrmg wrote: post #47
nathan_long wrote: post #26

Earlier quoted context omitted.

>> they have to convince a judge that the allegations are true, and that getting the keys to your random noise will produce evidence You are correct. However, suppose you encrypt some data and forget the key, or you store some radio noise in a file, or whatever. Later, you are accused of a crime. The judge issues a warrant. The data/noise is now evidence against you. You are presumed guilty, and it is impossible to p…

Why do you make the jump here to "you are presumed guilty"? Your guilt would have to be proved in a court just like for any other crime. Are you suggesting that the courts would somehow just believe, with no evidence, that it's encrypted data relevant to the case and you're wilfully withholding the keys?

You are not presumed guilty. But you are found guilty of breaking the new law which comes with a 5 year prison term if you were accused of being involved with terrorism or hiding child porn. Regardless of any evidence.

Re: UK anti-encryption law

#64

Post by adamt »

I don't like or support the legislation - but I think this is a bit of an over-reaction.

The law as I understand it says that if you've got data (and the context of the law is in focussed primarily on targeting terrorism, child-porn etc) that you've encrypted but refuse to give over the encryption keys to; then if the police then convince a judge that there is valuable evidence in the encrypted data, and you still refuse, then you could ultimately go to prison.

Is this really any different to a digital search warrant?

Sure this law, like many others, could be abused. But I don't see it as anything to get to wound up about.

P.s. what kind of person has a 32GB file of satellite noise to generate random numbers with?!

Re: UK anti-encryption law

#65

Post by Zenst »

lamby wrote: post #19
Zenst wrote: post #2

I stand by my argument that you can have a encryption key that is say 2000 characters long. Print it out 1 character per page and submit that in advance at your local police station, getting a receipt. You are then within the law. Now question is - compression can be views as encryption. How does that pan out if you use a non-standard form of compression that does not require a key as the compression formula is the k…

The legal system is not a computer program.

Nobody said it was and in that things are not always black and white and as clearcut as they could be. the case of random data - is it random data or is it encrypted being the case in point.

This is why we have resonable doubt in the UK and innocent until proven guilty. In France they have guilty until proven innocent and such a law as this over there would be alot more painful to defend in that respect. Personaly I like the Scottish system of Innocent until proven Guilty but with the added verdict of not-proven, this covers things were it is not entirely clear that your innocent and there are doubts, though not enough to convict a guilty verdict. That too me is a fairer system on balance.

Re: UK anti-encryption law

#66

Post by Albuca »

This reminds me of this American Case:

http://www.wired.com/threatlevel/2012/02/forgotten-password/

But on the whole, the whole article is scary and slightly unsettling. On the upside I dont live in the UK - But if we were to be traveling through the UK with our encrypted HardDrives, would we be targeted by the law?

Re: UK anti-encryption law

#68

Post by Jabbles »

16s wrote: post #30

It is impossible to prove a PRNG'ed file is or is not encrypted data. TrueCrypt volumes look identical to `dd if=/dev/urandom of=file.bin bs=512`. Create a few of each and then evaluate them using ent to see this for yourself. Edit: Link to ent http://www.fourmilab.ch/random/ You could prove the file is encrypted if it is indeed encrypted and you have the passphrase and the program to decrypt it, but outside of that,…

The wonderful thing about TrueCrypt is that you have plausible deniability. If one were worried about having to provide a key, you could provide one that revealed pictures of cats without revealing anything you wish to remain hidden, or indeed if there was anything further to reveal.

This makes this attempt at a law look even sillier.

Re: UK anti-encryption law

#69

Post by DanBC »

omaranto wrote: post #8
freehunter wrote: post #6

I have to wonder if this would ever hold up in court. I don't know much about the UK justice system, but in America it would be pretty rare to be convicted of a crime that they can't actually prove you committed. You could be jailed for refusing to comply with a court order to decrypt the file, but if you can prove it's not actually encrypted, they can't do anything about it.

How do you prove something is not encrypted?

In theory the accused is innocent until proven guilty, and thus should only need to suggest that the data is random, and pass the burden of proof back to the prosecution, who now have to prove the random data is encrypted.

File headers, existence of cryptography software and manuals, etc might be useful. Admission that the data is encrypted is stronger.

(http://www.computerweekly.com/blogs/the-data-trust-blog/2009...)

Re: UK anti-encryption law

#70

Post by omh »

theaeolist wrote: post #40

Isn't TrueCrypt's 'hidden volume' feature enough to make this law pointless? Just have two encoded sets of information in the same file. When you are asked to give the key it is up to you the key of which one you give. http://www.truecrypt.org/docs/?s=plausible-deniability

Or perhaps after giving the key to the main volume the police will insist that you give them the key to the hidden volume.

If you deny that there is a hidden volume then they'll just say that you're refusing to decrypt and prosecute you anyway.

Post reply on HN