Hacker News Reader

Comment by confounded | Hacker News Reader

The Guardian have more context: https://www.theguardian.com/uk-news/2017/sep/25/campaign-gro...

This was very clearly politically motivated to hamper the efforts of CAGE; a UK based group which lobbies of behalf of young Muslim men who have been detained without charge it gitmo, harassed by the security services etc.

Regardless of whether readers like CAGE's politics (which are considered inflammatory by the government), this raises a worrying precedent.

It's also worth noting that given the UK's recent authoritarian laws, he got off lightly --- this could easily have been spun to possessing encrypted data (while being unwilling or unable to decrypt upon command), which carries a two year sentence, IIRC five if the magic word "terrorism" is conjured.

View on HN

>possessing encrypted data (while being unwilling or unable to decrypt

How does this work with things like DRM? What if you have media on your phone from something like Spotify or Netflix that's presumably encrypted or protected in some way, that you cannot decrypt if your subscription expires...

My naive understanding of my country's laws is that it doesn't.

I could have a file filled with /dev/random and the law would still apply.

Back when the Regulation of Investigatory Powers Bill was being circulated, to much outcry from technical folk, someone encrypted a file with a provocative name and sent it to the Home Secretary for exactly that reason, as a form of demonstation-cum-protest.

Suddenly the Minister[0] possessed a file which he couldn't decrypt on demand. Would he consider amending the Bill to remove penalties for such eventualities? Of course not, nothing was changed.

If you possess the bytes you'll do the time. Delete everything that is unnecessary as soon as its usefulness has expired - big corps learned that lesson, for other reasons, in the early 2000s.

[0] well one of his staff

> Suddenly the Minister[0] possessed a file which he couldn't decrypt on demand.

While I entirely sympathise with this idea abstractly, so much of law depends on the context of actions where it's easy to dismiss this stunt. Merely having encrypted data in your possession is technically not within the scope of the law if the context is "as part of a counterterrorism investigation" and if the person could reasonably be expected to decrypt it (which would imply they were both the person to encrypt in the first place AND with the means to decrypt it - as this politician clearly wasn't).

Wrongful convictions and dragnet searches are the serious consequence of these laws, yes, but the real test comes when it's hateable/despicable people at risk. The problem with these laws isn't that it's fundamentally or potentially arbitrary, it's that it's wrong even when it's not arbitrary. And the mere fact of a police investigation or allegation is not sufficient to cross that line.

People should have the right to encrypt anything they want without being coerced into decrypting it. There are more than enough means for police in our modern technological era to convict terrorists/criminals and prevent conspiracies without having total access to all data. And the costs of removing that right is much higher than the rewards of a few extra convictions.

I'd guess that authorities would also have issues with situations where one purposely encrypts a hard-drive and disables decryption until later / confirmed safe by a third party. At the very least, that is what "Possession of encrypted data whilst being unable to decrypt it" sounds like.

It then becomes a grey area between having been sent encrypted data, and having used the previously mentioned scheme to avoid decryption.

I also wonder how this interacts with the new 5-tap SOS function on iPhones.

> Merely having encrypted data in your possession is technically not within the scope of the law if the context is "as part of a counter-terrorism investigation"

Not quite; the bar is not as high as an existing 'terrorism' investigation. To quote RIPA (2000)[0], if anyone authorized has the belief (upon reasonable grounds), that

    (3) A disclosure requirement in respect of any protected information is necessary on grounds falling within this subsection if it is necessary—
        (a) in the interests of national security;
        (b) for the purpose of preventing or detecting crime; or
        (c) in the interests of the economic well-being of the United Kingdom.

It is very very easy to imagine how this could be abused. Saying that you'd like to slap POTUS or May on Twitter could conceivably meet grounds for (2), and (3) is so broad that it's possible to imagine it could be triggered by something like being Alexandra Elbakyan of SciHub, or Sundae of The Pirate Bay. Depending on the mood of the press and the 'authorized persons', why not any old person caught using BitTorrent, or cracking DRM?

[0]: http://www.legislation.gov.uk/ukpga/2000/23/pdfs/ukpga_20000...

The point is that the law doesn't make any sense, and can be used to intimidate and imprison difficult people, at the Crown's discretion.

The idea is to create crimes that they can apply to anyone. Technically they apply to everyone, but they can then use selective enforcement based on criteria that the general public would never have openly tolerated as a law.

> How does this work with things like DRM? What if you have media on your phone from something like Spotify or Netflix that's presumably encrypted or protected in some way, that you cannot decrypt if your subscription expires...

Interesting point, but I think in this situation they'd be putting pressure on the media provider to decrypt it for them (since the media provider is the one in control of the encryption, not the consumer). That's assuming said media provider is in a jurisdiction that the relevant govt has some control over, and/or media provider is compliant.

Here's a thought experiment: suppose ISIS (or your preferred terrorist organisation of the day) set up a media service for users to share videos (or other media) that are protected by DRM. The media service can disable the viewing of said content on a whim. A person using this service has their phone/computer confiscated, but the authorities are powerless to gain access to the content due to the DRM. Is this person liable under these laws, even though the encryption is outside their control?

Imagine a malicious attack on a target where a cryptolocker is pushed to a victim, an anonymous tip is sent to the authority about the same person holding potential documents related to terrorism, and the attacker just throw away the key.

How can you even defend yourself?

>possessing encrypted data

Is... a crime? Woah.

If you don't provide the means to decrypt.

Absurd nonetheless.

With very selective enforcement.

Almost everyone with an internet connected device possess encrypted data.

Welcome to <current year>, where more and more math is considered illegal.

Well, more and more math is used for non-math purposes too, so the illegality is not exactly as absurd as it seems.

What is that supposed to mean and how does it make it less absurd?

It's supposed to mean that wondering something akin to "it's just math, how can it be illegal" doesn't mean much in an era when math are not just some abstract theory or things used to measure our plots of land, but are at the core of very important technologies with great applications and huge implications.

Not to mention that with digitization, every file is "just a number" anyway. Top secret document leaked? Naked photos of an ex posted for all to see? "Hey, I just shared a binary number on the internet" doesn't really hold water.

It might be politically abhorrent to persecute people for such things, but absurd it is not.

https://en.wikipedia.org/wiki/Illegal_number

Possessing random data is also a crime since it's indistinguishable from encrypted data, and if you can't provide the non-existent keys, your SOL.

Which is incredibly worrying as that 'random data' could it's self be a one time pad (the passphrase used for something else).

How does that make things worse or change the situation?

I think I meant to say:

You have no idea if a file contains something needed as part of a decryption process, or if the file itself contains encrypted informations.

So basically, having a "pad" file incriminate you.

Presumably in that the data itself is not criminal, and there could be no viable method to determine whether the data the key decrypts is criminal.

What's this "my SOL"?

[you are/you're] shit out of luck. IE: fucked.

http://www.urbandictionary.com/define.php?term=SOL

It certainly raises red flags, don't you agree? After all, what were you planning to do with those alledged "random" digits? What do you have to hide?

You really shouldn't be able to access /dev/urandum until you have been cleared by a reputable Alphabet company. This is for our security and that "obviously" trumps individual rights (whatever that means).

Root cause of all this is, of course, "bad thoughts" and "bad information", which IMHO should also be made illegal and only permitted in designated "free and error prone thought" areas and participants monitored by physicians from the Ministry of Error Free Thought.

Oh that gives me an idea. Let's make it so the blob can be decrypted 2 ways. One shows your tax receipts and spec indie-horror script, the other is your real shit.

TrueCrypt/VeraCrypt do that in a way.

Plausible deniability by allowing you to decrypt with one of two different passwords. One gives you access to the volume with your data, the other opens a shadow volume that contains random non-senstive data.

In the UK, yes. Holding encrypted data against the wishes of the government, that is to say you are unwilling to decrypt it for them, is a crime. I believe up to two years in prison.

That's actually fucking insane. Things aren't great here in the USA, but as another user stated, encrypted data is indistinguishable from random data. Someone could point at scrambled bits on your harddrive and accuse you a crime you didn't necessarily commit.

jeeeeesus

Its even worse. I heard of someone who was raided in London based on the fact their IP was busy with torrents. Two of his drives were encrypted. But guess what - it wasn't he who torrented but another person who shared housing/same IP. So he happily gave up the password. Unfortunately for him, one drive got open (with bunch of his emails) another one did not want to. Although he swears he used same pass for both, apparently the second drive got corrupted during transportation, which can happen very easily. He still sits in jail 8 months later. So when you ready to give out your password - pray your drives did not get corrupted.

Do you have a source?

(Not disbelief or concern trolling, I'd like to find out more about this case.)

> This was very clearly politically motivated

Well, it depends. Though some information there might be protected by "attorney-client privilege" today's verdict doesn't seem to support it

> IIRC five if the magic word "terrorism" is conjured.

Well, there is another way, but when people are more preoccupied with the rights of outspoken jihadists (not saying it's the case here) and not appearing racist in reporting crimes pressure shifts to those who have less connections to wrongdoings

I would much rather the odd "outspoken jihadist" remains free than live under an oppressive police-state with no privacy rights. And that's exactly where we're headed.

It isn't a dichotomy, but since I don't abide by self-loathing I'd rather see criminals arrested (without forfeiting privacy, since it's not needed in most cases)

I'd like to see criminals arrested as well, but it seems that most investigations into police misconduct are inconclusive. I wonder why?

I think Theresa May (and tens of thousands of bureaucrats) should be able to see everything on your phone at all times. Not anyone else's, just yours.

I specifically mentioned "without forfeiting privacy"

Where are you getting self-loathing from?

Reply on news.ycombinator.com