Stories
Slash Boxes
Comments
Search

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

UK Government Can Demand You Hand Over Encryption Keys

Journal written by iminplaya (723125) and posted by Zonk on Tue Oct 02, 2007 10:06 AM
from the shh-don't-give-them-ideas dept.
Privacy Encryption Security Government Politics
iminplaya writes "The UK government can now demand that citizens hand over their data encryption keys - or face jailtime for obstructing justice. The law only applies to data on UK shores, and doesn't cover information transmitted via UK servers across the internet. 'The law also allows authorities to compel individuals targeted in such investigation to keep silent about their role in decrypting data ... The Home Office has steadfastly proclaimed that the law is aimed at catching terrorists, pedophiles, and hardened criminals--all parties which the UK government contends are rather adept at using encryption to cover up their activities.'"
+ -
story

Related Stories

[+] Technology: UK Voters Want To Vote Online 288 comments
InternetVoting writes "A recent UK research survey by NTL:Telewest Business found that nearly half of the younger respondents would be more likely to vote online. This year the UK government has authorized 13 local election pilots including Internet voting. ntl:Telewest Business estimates 10 million UK households have broadband and 4,789 local libraries offer public access. In the US political parties are beginning to test the Internet voting waters with the Michigan Democratic Party to offer Internet voting in their 2008 Presidential Caucus. There were some notable differences in generational interest: 'The YouGov poll of almost 2,300 people, carried out on behalf of NTL:Telewest's business unit, found that younger voters were even more positive about the idea of alternatives to the trusty ballot box. 57 per cent of 18-34 year olds liked the idea of evoting, but only a third of the over 55s were as keen.' Given security and privacy concerns in the states, how likely is this to appeal to US voters? "
[+] UK Proposal To Restrict Internet Pornography Sparks Row 561 comments
An anonymous reader writes "The BBC reports on the row over proposals by the UK Government to criminalize possession of 'extreme' porn. The bill, published last week, would include the prohibition of fictional depictions of violence and images of acts between consenting adults. The law would also apply to screenshots taken from a legal film, if the screenshot was made for erotic purposes. The goal is to prevent disturbed individuals from accessing content online that would trigger violent behavior. From the article: 'Labour MP Martin Salter, who has worked closely ... in pushing the legislation, rejected the BDSM community's claims their civil liberties were being undermined. He said: "No-one is stopping people doing weird stuff to each other but they would be strongly advised not to put it on the internet. At the end of the day it is all too easy for this stuff to trigger an unbalanced mind."' The bill follows from plans initially announced last August."
[+] News: UK Copyright Extension in Exchange for Censorship? 238 comments
Awel writes "The UK opposition leader, David Cameron, says in a speech to the British Phonographic Industry that his party would work to extend the copyright term to 70 years and crack down on piracy. But in return, labels would have to agree to bear more 'social responsibility', which appears to translate into avoiding lyrics that glorify 'an anti-learning culture, truancy, knifes, violence, guns, misogyny'. He doesn't spell out how this would be achieved in practice. This follows the publication in December of a UK government report recommending that the standard copyright term in Europe remain at 50 years (and not be raised to 70 or 95 years)."
Firehose:Always a step ahead, those Brits by iminplaya (723125)
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

UK Government Can Demand You Hand Over Encryption Keys 25 Comments More /

 Full
 Abbreviated
 Hidden
More
Loading... please wait.

  • hmm (Score:4, Funny)

    by pak9rabid (1011935) on Tuesday October 02 2007, @10:09AM (#20822543)
    I guess when wire-tapping and CCTV just isn't enough
    • "I guess when wire-tapping and CCTV just isn't enough"

      The issue, of course, is that systems are being put into place that can be used against citizens who protest. By using "terrorism" to create fear, those who want corruption and control are building systems that can be used to give them more control. Laws that required centuries to build are now being thrown away with as little awareness by citizens as can be designed.

      The movie Zeitgeist explains it: The movie Zeitgeist (2007) [zeitgeistmovie.com] claims to explain it all, from an example of how people are controlled by myths, to how people who control government use fear to get more control, to why the U.S. government is pursuing a policy of hyper-inflation of the dollar now.

      The movie is free and can be downloaded using a BitTorrent client, burned to a CD (a DVD is not necessary), and most modern DVD TV players will play it.

      The Zeitgeist movie is very poor in some places, such as the opening sequences, and excellent in most places.

      Don't expect emerging consciousness of very difficult subjects like those in the movie Zeitgeist to be free of error. The movie correctly says that "resurrection after 3 days" is part of many ancient myths, with an astrological background. However, the movie also speculates that Jesus Christ may never have existed. That is beside the point. In fact, whether Jesus Christ existed or not, many people in the world thought that his ideas and the ideas of his follower Paul of Tarsus were an improvement over what they had before. Even many people who do not claim to be part of a religion think that.

      Those who want more information about how corrupters use fear can watch the free 3-Part BBC movie: The Power Of Nightmares: The Rise Of The Politics Of Fear (2004) [moviesfoundonline.com].

      For those who don't know, and want to know what is happening and why, those movies are an excellent and entertaining way to start.

      For people and their friends who invest in weapons and the manipulatable parts of the oil business, such as Cheney and the Bush family, controlling the government is how they make money and get more power. People from rich families often grow up believing that it is acceptable for them to kill people to get what they want. It is difficult, however, for the average person to believe that someone who already has a lot of money would kill others simply because he wants more money.

      I am surprised at how much conflict of interest is allowed in the U.S. and U.K. governments. Why are weapons and oil investors like Cheney and Bush allowed to decide about starting wars in countries that have oil? (Afghanistan may not have oil, but oil investors want to build a pipeline through Afghanistan.)

      Now the U.S. and U.K. governments are planning to start a war with Iran, another oil-rich country.

      TrueCrypt has "plausible deniability. I wondered why TrueCrypt [truecrypt.org] encryption software has "plausible deniability". I guess that is why. We will soon all be needing it.

      • Re:Life without public key cryptography (Score:4, Interesting)

        by Rei (128717) on Tuesday October 02 2007, @12:34PM (#20824755) Homepage
        Weren't the British planning to pass something like this years ago? I remember reading about it at the time. This law seems like it'd be either unenforcable (if the person can argue that they don't have or forgot the key), or asking for people to be set up (if they can't). Perhaps a less obvious version of the following:

        From: Anonymous Stranger (someone@outsidetheuk.com)
        To: Patsy (someone-else@inside.co.uk)
        CC: Law Enforcement HQ (help@police.co.uk)
        Subject: Confession

        Dear Patsy,

        I was just approached by an acquaintance who says he committed a crime for you. Not believing it, I asked for proof. He showed me this picture:

        (insert photo of apparent crime in progress)

        I was horribly disturbed when I saw this. Apparently, according to him, it's just a screenshot from a video of the crime and him talking about all of the details of it for you. When I asked why he felt safe keeping a video around, he said it's encrypted and that only you and he have the keys. I managed to swipe his USB memory stick, and sure enough, there's some big encrypted file on it. I'm attaching it below for you. Since the police will certainly be interested in what it shows, I'd advise that you hand over your encryption key to them immediately.

  • Been like this for years (Score:5, Informative)

    by CRCulver (715279) <crculver@christopherculver.com> on Tuesday October 02 2007, @10:12AM (#20822583) Homepage
    This law has been around for years. In fact, back when PGP was big, some UK residents on Usenet would have sigs saying something like, "If I revoke a key without explaining why, it is due to that law".

  • Not exactly news (Score:5, Interesting)

    by TheRaven64 (641858) on Tuesday October 02 2007, @10:13AM (#20822613) Homepage Journal
    RIPA has had a lot of negative coverage since the idea was first raised. Someone at the time proposed emailing the Home Secretary with a few MBs of random data and the text 'here is the information on your opium import operation. The key is as we agreed' and then sending a tip to the police. If the Home Secretary does not disclose the key (which he doesn't have) then he is liable for 5 years of jail time. Or, the government could see how silly the act is and repeal it. Since the law just went into force, I expect civil liberties groups will start trying this soon.

  • Hand the keys over (Score:4, Interesting)

    by DuncanE (35734) * on Tuesday October 02 2007, @10:15AM (#20822635) Homepage
    If a judge asked you to hand over the keys to your house.. or your car.. or your safety deposit box.. you are legally required to follow that order....

    Are we surprised that digital keys have the same requirement?

    And as for all the other (physical) keys you can refuse and let the courts (and a jury) decide.

    • Re:Hand the keys over (Score:5, Insightful)

      by CastrTroy (595695) on Tuesday October 02 2007, @10:49AM (#20823145) Homepage
      Digital keys are not physical items. This is like them demanding that you hand over your thoughts. In the US, and many other countries, there are laws stating that you have the right to remain silent, and that you don't have to testify against yourself. If you don't hand over the keys to your house, car, or safety deposit box, there's other ways of retrieving such physical objects by just taking them from you. If you don't hand them over, and they have a search warrant, they are allowed to break the lock. They can't do that with thoughts in your head.

    • Re:Hand the keys over (Score:5, Insightful)

      by itsdapead (734413) on Tuesday October 02 2007, @10:52AM (#20823199)

      If a judge asked you to hand over the keys to your house.. or your car.. or your safety deposit box.. you are legally required to follow that order....

      But...

      1. That will typically require a court hearing "on the public record"
      2. Even a technically ignorant judge should be able to decide (a) whether its your house/car/box (b) whether its plausible that you have lost the keys (c) whether the police have a reasonable justification for wanting access and (d) whether the fact that you have a lock on your door or possess a saftey deposit box is, in itself, suspicious.

      Unfortunately, as soon as computer technology is involved, even some otherwise highly intelligent people instinctively turn off their brain and may be convinced that the existence of an encrypted file on your hard drive is tantamount to being found in possession of a giant underground bunker complete with piranha tank, spy-bisecting laser and fluffy white cat.

  • Three Words (Score:5, Insightful)

    by ricree (969643) on Tuesday October 02 2007, @10:17AM (#20822661)
    Truecrypt hidden volumes

    This is exactly the sort of situation that hidden volumes were created for. The government asks you to hand over your encryption keys? "Well sure officer, here's the key to my encrypted volume, but there really isn't anything on there besides some harmless porn (or anything else that might be plausibly embarrassing enough to keep hidden away)" Of course, it's probably only a matter of time before someone decides to make it illegal to possess programs that can create any sort of hidden volume, but that's another issue.

  • So, lemme get this straight... (Score:5, Insightful)

    by R2.0 (532027) on Tuesday October 02 2007, @10:17AM (#20822665)
    A terrorist/pedophile/whatever is arrested, and his computer is seized. The authorities demand the suspect hand over the key, or he will face obstruction of justice charges and a year in jail. Does he

    a) Tell them to get bent, go to jail for a year as a symbol of government run rampant (face it, some "activist" will pick up his "cause")

    or

    b) Immediately hand over the key, which is then used to procure the evidence of his computer, putting him in jail for 20 years as an ACTUAL terrorist/pedophile.

    That's not even getting into the situation if one is NOT an actual pedorist. Terrorphile?

  • Solution? (Score:5, Insightful)

    by Cheesey (70139) on Tuesday October 02 2007, @10:17AM (#20822671)
    For private communications, don't send encrypted emails. If the encrypted email is captured by a wiretap, the fact that the ciphertext could be decrypted by the recipient is enough to allow the authorities to force that recipient to decrypt it.

    Instead, you should establish an encrypted connection, use it to exchange private information, then destroy the keys after the connection is closed. SSH is one protocol that does this automatically. That way, although a wiretap can record the ciphertext, the authorities cannot retrieve the encryption keys because they no longer exist. Your democratic right to privacy is preserved.

    I wonder if any instant messaging programs have implemented this? If so, do they consider the possibility of man-in-the-middle attacks as SSH does?

  • What if...? (Score:4, Interesting)

    by Opportunist (166417) on Tuesday October 02 2007, @10:35AM (#20822905)
    What if I don't have the keys but only store the data (i.e. I'm a backup service provider who stores data for people he doesn't even know by name or anything but IP address, which is fleeting at best)? What if I simply cannot remember the keys or, in case of keydisk/keyfile systems, have lost either (or destroyed because the archives are old backups no longer needed)? What if I don't remember which version of which cypher program was used to encrypt the keys (I tend to have that problem, actually, with a few archives...)?

    I don't have a problem handing the keys to the authorities provided they can give me a good reason they need them (I really don't enjoy handing out trade secrets, you know...), but what if I just simply and plainly cannot?

  • Dead-mans handle saves (Score:4, Interesting)

    by samjam (256347) on Tuesday October 02 2007, @10:35AM (#20822909) Homepage Journal
    Have an off-shore cron job to revoke your keys if you don't touch them often enough.

    When you are asked for the keys, refuse until you are arrested and unable to save the keys from being revoked.

    The revocation is the trigger that you have been asked.

    Sam

  • How to screw someone (Score:4, Interesting)

    by linuxwrangler (582055) on Tuesday October 02 2007, @10:37AM (#20822943)
    1. Place files full of random data on their machines

    2. Tip off the authorities to their "terrorist plans"

    3. Watch them get five years for "refusing" to decrypt the "data"

  • The really evil part (Score:5, Insightful)

    by ribuck (943217) <roger@eiffel.demon.co.uk> on Tuesday October 02 2007, @10:52AM (#20823197) Homepage
    The really evil part is that you can be forbidden from telling anyone that you were forced to decrypt your documents, under penalty of imprisonment. Without public scrutiny, this law is inviting abuse.

  • What if your password incriminates yourself? (Score:5, Interesting)

    by Bender0x7D1 (536254) on Tuesday October 02 2007, @11:32AM (#20823781) Homepage

    I was wondering how the court would rule if your password contained information that would incriminate you in a different crime.


    For example, if your password was: "my_murder_victim_is_buried_under_my_patio" or "I_embezzeled_20million_into_account_123456789", wouldn't revealing the password violate your right against self-incrimination (at least in the US)?

    • Re:hidden volumes (Score:5, Informative)

      by malsdavis (542216) on Tuesday October 02 2007, @10:19AM (#20822699)
      Because the law wasn't designed to work like that. The police can't demand "hand over all your passwords so we can route around for anything illegal", it has to be a specific key to a specific piece of suspected evidence (e.g. Database or file). If you had hidden volumes on an encrypted disk they would have no way to know there was potential evidence there and therefore could not demand you hand over the password.

      This aspect of the law is routinely ignored on Slashdot to try and enhance the "evil" reputation of the law.

    • Re:Old News (Score:5, Insightful)

      by Salsaman (141471) on Tuesday October 02 2007, @10:23AM (#20822757) Homepage
      Thankfully, it appears it has yet to be used in a non-terrorism related case.

      Since part of the law prohibits telling anyone that you have had to hand over the keys, how can you be sure about that ?

      • Re:Its very important that we all do this. (Score:5, Funny)

        by UbuntuDupe (970646) on Tuesday October 02 2007, @10:38AM (#20822959) Journal
        Hm, I generally go with: "Oh, you don't need the key; just factor the semiprime. What, you bad at math or something?"

      • Re:Its very important that we all do this. (Score:5, Interesting)

        by arkhan_jg (618674) on Tuesday October 02 2007, @11:51AM (#20824105)
        That's the problem - forgetting the password is not a defence. Failing to hand it over when asked carries up to a 5 year jail sentence, as it's assumed whatever you're 'hiding' would cause you to be imprisoned. The basic premise, if you use encryption, is that you are guilty of something and it's up to *you* to prove otherwise by letting the police rifle through *all* your data looking for something incriminating. Failure to do so is evidence itself of guilt!

        This law was passed 7 years ago, and the home office has been quietly waiting for the original outrage to die down to see if they could get away with actually using the powers they were granted before 9/11 or 7/7. Of *course* they'll only use it against terrorists and pedophiles. Nothing to fear citizen, sleep soundly in your bed, safe in the knowledge we're only imprisoning bad men. After all, only bad men use encryption then forget the password...

        Of course, if you're a pedophile you're far better off taking the 2 years for failure to hand over your encrypted data, than to take the potentially decades in jail if you have incriminating photos and a sex offender offence that might well get you killed there. I don't think it'll be too long before the maximum sentence gets raised to be in line with the worst crime you might be assumed to have committed and hiding via encryption...

      • Re:Truecrypt (Score:5, Insightful)

        by 49152 (690909) on Tuesday October 02 2007, @10:58AM (#20823289)
        I don't think you quite understand the principles behind "hidden volumes" in Truecrypt.

        The point is not that they don't know it is possible. The point is that it cannot be proven that there is a second encrypted volume within the first one.

        This makes it plausible to deny that it exist at all. If store some sensitive information in the outer volume, like some very embarrassing but not illegal pornography you can make a claim that this was the sole purpose of the outer Truecrypt volume. The law enforcement agency will have a hard time getting a judge to order you hand over keys to a hidden volume they cannot prove exist.

        Hidden volumes in Truecrypt got nothing at all to do with "security through obscurity", it's all about "plausible deniability". You can ask your friend in the police about that, if he has any experience with the security community at all he should be very well acquainted with this term.

        Of course, if you admit or in other ways make it provable that there exist an inner volume then all bets are off ;-)

        This will probably work in societies like USA and UK where the police have to follow certain procedures. In countries like Burma or China where they will just torture you until you confesses or dies, I'm not so sure about the value of this scheme.

All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2009 Geeknet, Inc.