UK Government Wants a Backdoor Into Windows

REBloomfield writes "The BBC is reporting that the British Government is working with Microsoft in order to gain backdoor access to hard drives encrypted by the forthcoming Windows Vista file system. Professor Anderson, professor of security engineering at Cambridge University, urged the Government to contact Microsoft over fears that evidence could be lost by suspects claiming to have forgotten their encryption key."

China & PGP

Well, to be fair, a few people do believe that Microsoft has a backdoor built into their OS [cnn.com] that would allow the United States Government to shut down all Chinese Government PCs running Windows.

Oh, and there are a few people who also consider encryption a matter of freedom of speech [wikipedia.org].

Funny the U.S. government targets Phil Zimmermann [philzimmermann.com] for three years but hardly raises so much as an eye when an encryption enabled OS is distributed. From Mr. Zimmermann's homepage:

Philip R. Zimmermann is the creator of Pretty Good Privacy, an email encryption software package. Originally designed as a human rights tool, PGP was published for free on the Internet in 1991. This made Zimmermann the target of a three-year criminal investigation, because the government held that US export restrictions for cryptographic software were violated when PGP spread worldwide.

I think that his "criminal activity" was creating an encryption tool that allowed messages to be encrypted beyond what the United States government was capable of deciphering in a timely manner. Does anyone know if this is still enforced? Does anyone know what the max key length is now if it is? I think it was something like 128 bits (that the government could crack) around the time of PGP.

Re:China & PGP

It wouldn't surprise me in the least if the US govt has had a back-door inserted into Vista. The problem for the UK govt is that clearly the US govt doesn't want to share it with them. And would the uS govt want to allow any other govt to have their own back-doors, with the potential to remotely access PCs running Vista in the US? Somehow I doubt it.

Re:China & PGP

seems we may see the fragmenting of the OS market with each local government insisting that only a domestic version be sold within its borders all in the name of security.

Backdoor code

You know what the secret code for the backdoor to encrypted data on a harddrive running Vista is gonna be, don't you?

Up-Up-Dn-Dn-Lt-Rt-Lt-Rt-A-B-A-B-Ctrl-Enter

Re:Backdoor code

I was going to guess "XYZZY" but I guess I'm showing my age.

-Coach-

Re:Backdoor code

'plugh' might work as well...

i'm old too...

Re:China & PGP

You may remember the "clipper chip". The idea, proposed during the first Bush administration, was that encryption technologies would have to include a back door for U.S. intelligence agencies and law enforcement. I forget whether this was just for export, or whether it included domestic products as well. The argument "pro" was that we could trust the U.S. government not to misuse the key; the argument "con" was that it would inhibit exports of U.S. products, because while Americans might trust their government with keys to their back door, why would anyone else? And there was also the issue that foreigners might be smart enough to come up with something that the NSA couldn't crack. I was disappointed to see the Clinton administration follow through on the idea. Ultimately, export controls were relaxed somewhat, but I'd be surprised if there weren't back doors and/or key cracking algorithms available in Fort Meade. (sp?)

It'll be interesting to watch this play out. I'm sure any resolution will disappear deep within the inner pages of the paper, if it is discussed at all.

Interesting Points

US export restrictions for cryptographic software were violated when PGP spread worldwide.

This bring up an interesting point on ITAR and the US. Some encryption technologies could violate ITAR if they are done in the US and then exported to other countries. If I remember right, that was part of the reason encryption on OpenBSD was done in Canada.

Oh, and there are a few people who also consider encryption a matter of freedom of speech.

Some would, but how many governements and what is protected under the law. That is different everywhere. Others, also, consider it a privilege.

Some of these laws, in paticualr with the US, are actually there to protect it from other countries. Many people in the country may not want to protect the countires competitive edge but others do and that is part of what our government has been taked with for a long time.

Re:China & PGP

Funny the U.S. government targets Phil Zimmermann for three years but hardly raises so much as an eye when an encryption enabled OS is distributed.

Not anymore, they have at last relaxed their restrictions, but they still did for a while - remember Debian nonus mirrors? The weak SSL in versions of IE4 shipped outside the US? OpenSSH having to be developed in Europe? The fact that you still have to download a separate file to get unlimited strength crypto in Java? And officially speaking you still have to notify the US government you're distributing strong encryption.

I think that his "criminal activity" was creating an encryption tool that allowed messages to be encrypted beyond what the United States government was capable of deciphering in a timely manner.

He was charged with exporting the munition - the problem wasn't so much that he'd created said encryption tool as that he'd put it on an ftp where $NASTY_REGIME could get it.

Does anyone know if this is still enforced?

As I said, officially speaking you have to notify the US government if you are exporting strong crypto from the US, and I think you're not allowed to directly export to anyone on their list of bad guys. In practice I don't think they care any more, crypto is so widely available.

Does anyone know what the max key length is now if it is? I think it was something like 128 bits (that the government could crack) around the time of PGP.

You weren't allowed to export more than 40, and AFAIK that hasn't changed.

Truecrypt

Let them try.
We have alternatives.
http://www.truecrypt.org/ [truecrypt.org]

If you are caught having...

...the TrueCrypt binaries alone in your possession then every piece of digital media you own that appears to contain random bytes will be accused of holding an encrypted volume and they will torture out of you whatever they want to hear you say.

Oh wait, I forgot... civilized Western nations never commit torture upon their subjects.

Plausible deniability ... and continued access

It's worth noting that harm can come not only from data being revealed under coercion, but also from data becoming unavailable.

If terrorists or an oppressive government take your computer and hard drives away, anyone who depends on that data is very much out of luck.

For this reason, local encrypted filestores and plausible deniability are only part of the puzzle. Quite a lot more is required, in particular cryptographic online distribution.

A comprehensive solution will need to use a large population of fixed size raw dataspaces spread across the net, instead of local disks. Quite likely, it would be stored steganographically 1:<large-N>:1 so that (for example) changing webcam images could be used as repositories. And it will need cryptographically-random access for site selection and dataspace selection and to individual bits in the dataspaces. And it'll need huge redundancy since the online storage will be inherently unreliable, yet without laying the scheme open to pretty simple differential cryptoanalysis.

That's a very tall order.

Private Disk

Well, TrueCrypt is freeware and open-source, but there is also another aspect that has to be taken into account - it is NOT a certified product.

Institutions such as NIST test the implementations of the algorithms, then the program either gets certified or not.

The problem is that without certification, we do not know whether what they've implemented is what they think they've implemented*.

The point is that they might use some obscure algorithm nobody knows - which has no guaranteed strength; thus one cannot rely on it. They can also implement standard algorithms such as AES or DES - but were they correctly implemented?

Sure - "why don't you take the sources and look at them yourself?" some might say, but is everybody competent enough to do that?

On the other hand, implementing something and then certifying it, means that:
[a] it was done right
[b] it is as strong as the standard says


In the case of encryption, the strength is in the key itself and in the mathematical basis of the algorithm, NOT in the obscurity of the mechanisms applied within the software.

One minor thing - NIST certification is expensive, I doubt TrueCrypt will pass it, unless some company pays for this. Commercial encryption software is a different thing, if they want to be treated seriously, they must go for it. An example is Private Disk [dekart.com].

* an old saying:

"The problem with computer programs and programmers is that the program does what the programmer wrote, not what he thought he wrote".

Re:Private Disk

> The point is that they might use some obscure algorithm nobody knows

But they don't (invalid point).

> They can also implement standard algorithms such as AES

Which they did.

> but were they correctly implemented?

Yes. Ever heard of test vectors? It's easy to verify if a cipher is correctly implemented using official test vector sets.

> One minor thing - NIST certification is expensive, I doubt TrueCrypt will pass it, unless some company pays for this.

Now, I bet you are the developer or seller of the commercial encryption software you mentioned. Your message basically is: "Look, without money they are worse than us. Commercial stuff is better. Free software sucks." You are just a troll.

The most important point is, however, that being open source is a _premise_ of any security software that is to be trusted by general public. Closed source security is not real security.

Re:Why?

This simply doesn't make sense. What prevents an user, using a different tool without said backdoor?

Laziness, ignorance; the same that prevents them from using encryption now.

Re:Why?

Err... You did not understand the target.

The problem UK govt is having and US govt will have the moment they realise what is going on is that any media files on Vista PCs when distributed correctly via the supplied Vista Windows Media frameworks will be immediately encrypted and locked down using the TPM module to the specific machine. On top of that this will be determined by the people who distribute the files, not the users. This makes the current approach of taking disks out and hooking them to a forensic environment unfeasible. They will have to be decrypted on the machine after the user has logged in. It is sufficient for the user to refuse to log in on the machine and the police is stuffed.

As a result any attempt to collect proof of child pr0n and b00tleg movies/music will run into some serious difficulties as long as the providers of illegal goods have done their job of using Windows Vista right.

Frankly, the UK govt should whinge elsewhere. MPAA and the TP group is a good start. Whinging at MSFT is not going to get them anywhere because it will be not just MSFT, it will be everyone implementing this on every device in 5 years time.

Suggestion

They do a google search for "backdoor" and "windows", then just take their pick. Microsoft if nothing else, offers a variety of backdoors for your every need.

IE

Internet Explorer will offer all the back door access they need

Backdoor action?

What good is encryption if your government can read it - before long half the criminals in the country know how to decrypt your files - especially they way the British Secret Service has been losing laptops lately....

Pfff

Let bad guys use deniable encryption schemes and this won't even be a concern... Please, someone in the U.K. gov get a clue about encryption!

Re:Pfff

What bad guy would be stupid enough to trust any encryption or security scheme introduced by a major corporation to begin with? If you want encryption, you go with open source. With any corp that has to answer to the government, you'd might as well assume there WILL be a backdoor.

In the end, the bad guys will use real encryption and the backdoor won' effect them. It will only serve as a security risk for legitimate users.

-Eric

Re:Pfff

In addition, you'd want a system whereby you could enter a distress password, and unlock one level of security, while at the same time transparently destroying data, from the most secure level on upwards. So let's say you had three levels of encrypted data. The first layer is just some dodgy pictures of you and your wife. The second contains some emails showing you were evading taxes. The third is whatever you really want to protect.

For each level there are two passwords, one which will unlock it as normal, and another which will unlock it, and also begin a routine which will start securely erasing the third level data, then the second level, and then the first level + OS, and maybe trigger a lump of thermite sitting on top of the RAM for good measure. Or maybe it would be better just to get rid of the third level silently, so that it's as if it never existed. That's probably healthier, on second thought.

So that after you provide a good show of resisting giving out the password, you hand over the 'distress' one and let them have fun getting through the first level of junk data, while at the same time the system is slowly eating away at the stuff you really don't want, down on the third level.

You could even set it up so that the mal-effects caused by the distress passwords increase as you move through the levels of security. The distress password on the first level of security just starts the "silent erase" mechanism. The distress password on the second level speeds it up at the cost of less subtlety (because obviously they're getting closer to the actual data, so you need it gone faster). The distress password on the third level physically destroys the system in some sort of obvious (but quick) fashion. That way you're almost guaranteed not to compromise the data, but you also don't have to necessarily compromise yourself, unless they're really close to getting the stuff.

Obviously you have never used real encryption

You should not be able to read the files without logging into the computer with your password and/or other identification token.

After logging in, the files are accessable. But not before. Someone who just swipes your PC would boot into Windows but would be unable to read any data files, even with a seperate boot CD. That's the whole idea.

But if the government adds a backdoor, you can bet that a hacker (white or black hat) would find it as well, probably within a few weeks of the OS being out. Thus making the encryption useless.

The whole government complaint is useless anyway because for all they know people can be using deniable encryptionn schemes *today* and they'd never even know about it.

Re:What is the point of filesystem encryption?

Why in the world would they have to boot your computer simply to read your hard drive?

Because all the sectors on my hard drive are encrypted on the fly. When you read it directly in other computer all you get is nearly random gibberish. There's not even a proper filesystem on it. Only after you mount it giving my long and convoluted passphrase the OS decrypts the sectors on the fly, so you can read the files. Switch the power off, reboot my machine or unmount the partition and there is no way to access my data again.

Is that easier to grok?

Robert

Keyloggers

Worth pointing out that keyloggers are exactly the route that the FBI here in the US has taken:
http://www.epic.org/crypto/scarfo.html [epic.org]

That's US v. Scarfo; basically a mobster was using PGP to encrypt his communications and rather than breaking the encryption the hard way, the investigators got a warrant to install a keylogger. I'm not sure exactly how they did it, but I'm pretty certain that it was a hardware device implanted in the keyboard, rather than software. (The warrant they got was pretty much a blanket thing, approval for 'hardware, software, and firmware as necessary...') However they didn't divulge the exact methodology in the trial, because they successfully claimed an exemption under the Classified Information Procedures Act.

Re:What is the point of filesystem encryption?

How will getting hold of the computer give them the password? It's not stored on the computer.

No, it's stored on the PostIt note on the monitor.

They just need to wait...

... until the crack is published :) (sadly this is more insightful than funny)

Let's be fair...

\ They just want to play with the big boys. We all know the NSA, the CIA, and the FBI each have their own key! \

Eh?

Why don't they just use one of the hundreds of backdoors that everyone else uses? Seems to me M$ are already complying with this request several times over.

That's the point of encryption isn't it?

Pretty sure that's the point of encryption. Making sure that nobody but you and people you trust can read your data, and anyone else up to and including the government can't. Even if they really really want to.

When did a healthy mis-trust of government suddenly get you tin-foil hat status, and a visit from the FBI?

The day after the big attack

When did a healthy mis-trust of government suddenly get you tin-foil hat status, and a visit from the FBI?

In the US, 12 September 2001.

In the UK, 8 July 2005.

You get the idea.

After a major terrorist act, the population is angry, not rational. Many are personally affected by the attacks. Thoughts of proportionate responses and civil liberties are overwhelmed by fear and grief.

This is, of course, the ideal time for a government to try to increase its own power at the expense of the people it should represent. This goes double for governments with only a tenuous hold on power, as is usually the case in the US because of its two-party politics, or for governments whose very mandate is dubious, as is the case of Blair's UK government (which didn't actually win the popular vote in England, and has often relied on the votes of Scottish MPs to push through controversial legislation to which their own constituents will be immune because the Scottish Parliament will decide for them separately).

Hence it is precisely in the wake of a terrorist atrocity that we should be keenest to protect our civil liberties, for it is at these times that they will naturally come under the gravest threat.

What about the RIP bill?

From TFS:

Professor of security engineering at Cambridge University, urged the Government to contact Microsoft over fears that evidence could be lost by suspects claiming to have forgotten their encryption key.

Then lock them up for that. It's a crime to not provide your key under the RIP bill [parliament.uk]. If the government is going to pass stupid legislation like that, then they shouldn't need these backdoors.

Not "lost"

This is that definition of "lost" that appeared in the late 20th century. It's akin to the money that the music industry is "losing" due to file sharing. The evidence is not lost, it is as yet, undiscovered, and in any civilized country, we would not assert that there WAS any evidence unless we could actually see it. In the U.K., however, they actually have a law that says that you have to reveal your secret keys to the authorities with no provision for simply not knowing them. You can be convicted of the crime of having white-noise on your disk that authorities assert is encrypted data to which you are refusing to reveal the key. Heck, you could be convicted of a crime for not divulging the key to /dev/random, which is clearly some secret message channel from an unknown party, since messages arrive from it in small bursts!

Contempt of court

I often see arguments like this one [slashdot.org]. What's the point for some people to encrypt their files (other than temporary privacy) if you're going to get in trouble later in court anyway for not revealing your keys? Now this might actually be unlikely, but what if average windows user genuinely forgets their password? Seems kind of unfair.

Re:Contempt of court

One would hope that you're not going to be forced to reveal your password unless the Government establishes probable cause that you've committed a crime.

It's kind of silly to think that an average user with no incriminating evidence encrypted is going to be randomly ordered to turn over a password, and thrown in jail for legitimately forgetting it. It's a disturbing thought that the law, as written, could lead to that, but it's not a compelling argument against using encryption if you're not a criminal.

Using this sort of hypothetical scenario to argue against routine use of encryption is a bit like arguing against keeping sharp knives in your kitchen, because you're afraid the police might claim you stabbed someone with one of them and cleverly removed all forensic evidence of the stabbing from the knife.

Great!

If governments force a backdoor to be installed, it'll be for sale to crackers before the gold masters are pressed, and common knowledge a few weeks later. So "trusted computing" can be subverted using the govt master key. And anyone who actually wants to keep secrets will install somethng that works while not requiring a magic dongle on the mobo. The govt will be able to read data from clueless suspects as they do now. So a win all round. And who doesn't suspect MS would leave backdoors anyway?

Inevitable

It was inevitable something like this would happen after the whole 90 day detention debacle. Labour kept using the excuse of "needing time to break encryption" for requiring 90 days of detention without trial. Anyone with half a brain told them that any decent encryption is going to take many years to break, so I guess this is their response.

What's the point when you have RIP?

I don't really see why the need this anyway.

The government has the RIP Act [wikipedia.org] (Regulation of Investigatory Powers Act 2000) which allows them to detain you, with a press gagging order if you refuse to hand over the encryption key they need to decrypt your data. If you refuse or claim you have forgotton and they don't believe you, then it's two years in gaol for you sonny jim.

They only really got this into law because most people don't understand it. Oh and don't forget that since this government came to power the amount of time they can hold you, uncharged, under the terrorism act has gone from 7 to 28 days... and the police want 90! Yes ninety days, 3 months, 2160 hours!

keyloggers

How about making governments install a keylogger before they seize the computer? Hardware or software, it would go in the old tradition of installing a telephone tap. It's not that hard either. Did the government demand that paper notebook makers supply a backdoor so they could decipher drug accounts written in code?

As usual, the wrong solution to the problem

Anyone with something to really hide will use a third-party encryption system, and "lose" the keys to that instead.

Everyone else* will have a computer with a guaranteed back door, which I am willing to bet will be open to hackers on about Day 3 after Vista's launch.

* - Well, everyone else who's not running Linux, of course.

Don't attribute....

to idiocy what can be explained by malice. There are a lot of backdoors around, and Windows had functional ones for years (wmf anyone?) but the intentionality of them could have been in doubt. Now if is known, proved, and by design adding another backdoor, one that will not be removed by any hotfix because is a "feature", well, 2 things will probably happen: the bad guys will find how to exploit it making all backdoored windows a target, and the bad guys find know how to disable it, so the most harmed people will be the good ones that should not have anything to hide (and because of that, removing/disabling the backdoor would make them suspectful)

Trusted computing? HAH

Why would anyone consider 'trusted computing' some binary program which you haven't compiled yourself is beyond my understanding.

since when...

Since when does the government have a right to all evidence in any case? One aspect of English law that I thought existed, is that the people should be protected from the government (particularly from self-incrimination). One could reasonably argue that the average citizen needs the availability of government-inaccessible encryption, due to the decreased cost (in terms of time and manpower) required to search through computer records vs. paper records. Current computers, and the massive amounts of data that they store (internet cookies, browsing history, cache data, registry entries, etc.) make fishing expeditions much, much, easier on law enforcement than sifting through physical documents and interviewing co-workers and family.

"Forgetting" your key is an offense

Not turning over the key (for any reason) is an offense punishable by a couple of years in prison anyway.

 

Time to switch!

OS X FileVault...AES128 encryption of your home directory with no backdoors! (At least not that I know of). Ain't nobody reading your files without your key.

Where will it end?

Not that I would ever buy Windows Vista, but why would I want Microsoft deciding who gets backdoor keys to my machine?

I recall some years ago, someone found supposedly secret NSA backdoor keys buried in Windows98. I don't recall if it was actually proven, but I would not be surprised if the NSA already has backdoor keys in 98/ME/XP and now Vista. Now the British Government wants their turn. Where will it end? Once MS bows to the British, surely other governments will also demand backdoor keys. Who decides which of those governments get it?

Sooner or later, other organisations (like the RIAA and the MPAA) will also want their keys too (if they don't already have them thanks to their DRM chips). Where will MS draw the line? I highly doubt MS would be very open about how many different governments or other organisations really have backdoor keys.

It is easy for us to say that we'll never use it, or that there are other options out there, but I'm more worried for less computer savvy members of the public who think they are buying a secure system. I know most of those users will never use encryption, but this will set another precident that will further erode all of our rights.

Why use the back door...?

When the front door is wide open?

Sorry, cheap jibe.

This is amazing - especially when the idea is being promoted by a 'Professor of Security Engineering' at a reputable university. How can adding a backdoor to security systems be anything other than a massive weakness just waiting to be exploited?

Imagine if this went ahead - the British government would want access to versions of Windows sold in this country, the American government to US copies of Windows, the German government ... and so on and so on... Would Microsoft allow the Chinese government access to their citizens' disks? The Chinese government are signed-up members of The War Against Terror - so they could claim they need access, and besides recent experience says that big businesses will always accommodate governments no matter how repressive.

And it gets worse. Microsoft would either have to make a single key that would open every machine in the World; or they would have to issue copies of all the keys to every government - the British government won't accept not being allowed into a suspected terrorist's (and we have a splendidly wide definition of 'terrorist' in this country) computer purely because the suspect happens to be foreign.

But it will all supposedly remain secure and not fall into the hands of wrong-doers.

The Home Office, IT and Microsoft - what an unholy trinity we have there. With this level of stupidity the legislation can't be far off.

Encrypts your whole hard drive by default?

FTA:

The system uses BitLocker Drive Encryption through a chip called TPM (Trusted Platform Module) in the computer's motherboard.

It is partly aimed at preventing people from downloading unlicensed films or media.

"This means that by default your hard disk is encrypted by using a key that you cannot physically get at...

The government shouldn't be the only folks horrified at this one. MS wants to turn your entire computer against you, encrypting all of its contents and allowing you to read it only if MS wants to allow it. Even if you're okay with that, imagine if something in the scheme goes wrong? I've used the Windows Encrypting File System in XP, and if you lose your encryption key (not that hard--say, if you reformat your hard drive) you are permanently locked out of all the data you've encrypted.

If this is true, MS really wants a death grip on your computer. I'd never use Vista under those circumstances.

This is fantastic news to hear.

Anyone who values their privacy already uses non-OS provided encryption. This will raise public awareness of the need to do the same.

The pleasant result of all this is that it dispells the whiff of paranoid conspiracy-theory. The government has been advised to ask for the backdoor access. By a british Cambridge expert. There is every reason to think Microsoft will agree.

There is now simple historical evidence to point the public to. Previously there were more technical , less convincing ones.

The average person is not going to care if Microsoft accidentally included some debugging code in a patch. Even if that made it look like it had a backdoor key. "Whatever that means?", they'll say.

A BBC news article about an expert asking for such a backdoor is a lot more convincing.

Re:This sounds like misreporting to me

Sounds to me more like the good guy is making a really smart play. Note that it looks like he sort of slipped this in as an aside, since he was really giving evidence about "holding terrorist suspects without charge". Talk about pushing all the right buttons on the govt. machine.

If you are an opponent of TCG / TPM / DRM it is really quite beautiful. As far as I can see it is something like:

"Hey Mr. Government Committee, while you're asking me about terrorist suspects you might want to note that this new TPM / DRM stuff coming real soon from MS/**AA now will make it virtually impossible for you to get info off suspects' PCs. Oh, and the PCs are setup that way by default so no chance of using that fact against suspect. Also, you know that law you fought so hard for where you can jail people for not handing over encryption keys ? - well with this new stuff the key's in hardware and the suspect never has it. If you're worried by this, then maybe you should speak to these guys about crippling the tech..."

Aim big nasty government machine at big nasty corporate machine, stand well back...

Sweet.

"A back door into Windows."

The jokes really write themselves.

Seriously, though, I'd store inciminating stuff on something I could get rid of more easily than my hard disk.

Digitial Evidence IS NOT

When will the courts realize the bloody obvious fact that bits on a hard drive are evidence of nothing! Until computers are not able to be remotely hijacked with all tracks erased, there's no way to prove who put the bits there!!!

As more and more traditional forms of evidence (audio tapes, photos, DNA records, VOTES for god sakes) become digitized, the more we need to be skeptical of them.

And don't bring up digital signatures so long as keyloggers exist.

I don't trust the MS Encryption anyways

I used to use BestCrypt as a means of keeping encrypted volumes, but I found TrueCrypt a while back and have been very satisfied. It's open source, cross-platform, and generally works very, very well. For something as important as encrypted data I want to be able to look at the code myself (and more importantly, I want a lot of other people looking at it so they can blow the whistle on any inappropriate backdoors and such).

USA & 5th amendment

I'm not sure about the UK, but in the USA, wouldn't this be a 5th amendment rights issue?

The summary states that this black hole is desirable for "fears that evidence could be lost by suspects claiming to have forgotten their encryption key", but why would a suspect have to say they lost their encryption key? Why not just plead the 5th?

The 5th amendment states: "No person shall [...] nor shall be compelled in any criminal case to be a witness against himself [...]"

I honestly do not believe that the contents of a person's hard drive falls into the same category of evidence as eye witnesses or DNA. A personal computer's hard drive, particularly one with an encrypted file system, is effectively an extension of that person's memory and hence any data extracted from it seems very much like testifying against oneself.

Oppression by the Police State

Britain has sadly already become a police state. Only criminals and cops have guns, cameras everywhere, illegal to state non-liberal opinions, and now this. Once the control structure is fully in place, most Brits will find themselves being openly persecuted. Anyone want to bet how long it will be before they start implanting RFID chips in everyone? They'll start with the kids and say it's for safety.

Unfortunately, some in the U.S. want that here. I hope the red states can save us.

Well.....

"UK Government Wants a Backdoor Into Windows"

Makes a change, Tony Blair's been making his back door available to Bill Gates since he came to power.

Lotus Notes was 'compromised' thus long ago

Lotus Notes was 'compromised' thus long ago. See http://www.google.com/search?q=Lotus+Notes+Swedish +Parliament [google.com].

oh please, yes please

He said: "From later this year, the encryption landscape is going to change with the release of Microsoft Vista." The system uses BitLocker Drive Encryption through a chip called TPM (Trusted Platform Module) in the computer's motherboard. It is partly aimed at preventing people from downloading unlicensed films or media.

oh please, yes please. switch on encryption that uses TPM. then all it takes is a virus to overwrite the TPM keys in the BIOS memory and that's it - game over: your entire hard drive rendered useless. mwhahahahah