Hacker News Reader

Comment by nathan_long | Hacker News Reader

His argument is: 1) They can lock you up for refusing to decrypt something. 2) Encrypted data looks exactly like random noise. 3) Encrypted data can be hidden in any file. 4) Therefore, they can allege that nearly anything is encrypted and lock you up on that basis.

I'd say that's terrifying.

Another thought: doesn't this make it possible to frame someone by writing random data to their hard drive?

View on HN

Yes.

From the comments (credit to http://www.ktetch.co.uk/p/about-me.html):

"Funny thing about the RIPA act was that in 1999, when the act was first discussed, civil Liberties group Stand decided to show the problem.

They sent an email to the Home Secretary (the minister for law and justice) containing a confession (source http://www.zdnet.com/surveillance-straw-petitioned-on-commer... ). That confession was encrypted. Mr Straw had details to a crime in his posession, in an encypted file, and no way to decrypt it. He was, under the letter of the law, refusing to decrypt information relevent to a crime, and should therefore be charged under RIPA.

Guess who wasn’t charged? Yes, the law doesn’t actually apply to you is you’re the Home Secretary. Who knew that those in government consider themselves above the laws they inflict on others."

And the reply to that:

"This argument is ridiculous, since it’s missing the concept of intent. The Home Secretary clearly had no intent. That’s why he/she wasn’t charged."

So a law which you have to prove yourself innocent and can be applied to anyone - but the police get to decide who to apply it to.

nope, can't see any problem with that.

And the reply to that is that there is no criteria requiring intent in this law.

And the reply to that:

The UK law in question does not require intent (mens rea).

It appears that way. Mens rea is a legal concept applied to some of common law (although not always effectively).

http://en.wikipedia.org/wiki/Mens_rea#England

EDIT: British common law divides up laws between those requiring intent and those that don't.

> Yes, the law doesn’t actually apply to you is you’re the Home Secretary.

Well, no. The law doesn't say 'if you have encrypted information you have to decrypt it'. It says 'if you have encrypted information you have to decrypt it if the police (or someone else with statutory powers to detain your property) require you to'. The HS wasn't required to.

You can't just email someone an encrypted file and key, snap your fingers, and have them be breaking the law. They have to actually refuse to comply with a notice.

Yes, it's a stupid law, but this stunt doesn't actually show anything.

But the email that was sent was a confession, so it was related to the open case and needed to be decrypted.

The law doesn't work like that. It doesn't matter how important it is - if the police haven't given you a notice to decrypt it, the statute isn't engaged.

So they are infringing on personal privacy, and practicing selective enforcement? If this came to America everyone would be brown from the big shit storm.

Patriot Act

> and practicing selective enforcement?

This is really a terrible analogy for reasons laid out up above. The law says you must do X when asked. You have not been asked to do X, therefore you don't have to do X.

Search for outrage elsewhere.

Technically, no. "Selective enforcement" is when the authorities selectively choose whether to arrest and prosecute someone for breaking a law. That's not quite the case here, as there is no breach of the law unless & until a notice is sent and been refused.

Technically you are right. Essentially the difference is bullshit. They simply don't send a notice to people they want to selectively ignore.

Think of it like a stop-and-search power. It is too wide, but not choosing to stop and search everyone who they have the power to isn't really like selective enforcement - it's just a power they can choose to use if they feel they need to.

In America that is a violation of 4th amendment rights. Now clearly this applies to UK, but we didn't fight the UK in a war for nothing.

I'm not very familiar with US law, but a few moments googling suggests that that's nonsense, and the standard the police must reach to conduct a stop and search in the US, for e.g. weapons ("reasonable suspicion", per Terry v Ohio), is essentially identical to that in the UK ("reasonable grounds for suspecting"). Though the UK statute does cover a slightly wider class of items - e.g. stolen property, rather than just guns as in the US.

(It's true that the reasonable ground requirement was removed for certain areas by the Terrorism Act 2000. That provision was held incompatible with Article 8 of the ECHR (our nearest equivalent of your 4th amendment), and has consequently been repealed).

I'd also raise an eyebrow at your implication that the police are generally less prone to misuse of their powers in the US than the UK. I haven't researched it, but my impression was that in practice it's rather the other way round.

The ultra fragmented nature of the police forces in the states lends its self to this unfortunately.

What the USA needs to do is to move into the 20th century and for each state to have a single police force with uniform standards - this would save a lot of resource wasted by every city/town having its own police force plus state troopers, sheriffs and what have you

That appears to be incorrect. Looking at the actual law, via the link provided on the submitted site (not just the section linked to, but also the surrounding sections), it looks like in the above situation you would be off the hook.

See section 50(3)(b). Also relevant is 53(1) and 53(4).

Fortunately its nowhere near that bad. The prosecution needs to prove beyond reasonable doubt that the file contains encrypted data and that you have the key. So if you did have a file of random noise then the police would not be able to prove these things. And if you had software for using that file as a random number stream then that would be evidence in your defence. Remember, its for the police to prove your guilt, not you to prove your innocence. And the law in question does actually talk about that.

If someone wrote random noise to your hard drive then they couldn't prove these things (and in that scenario it would be a lot easier to frame someone by simply writing some child porn).

Encrypted files are not usually just cyphertext: there tends to be a header file with the file type, and of course there will be associated decryption software on the disk. Time and date stamps may well coincide (e.g. the decryption program was last run at the same time the suspect file was accessed). All of this would help build a case that the suspect had in fact decrypted the data in the past, and therefore could do so again.

As for steganography, they would need some clear evidence that the alleged steganographic data existed. Merely saying "maybe" and a pound will get them a cup of tea.

Does innocent until proven guilty and beyond a reasonable doubt apply to UK criminal law?

It is right there in the section linked from the article:

(3) For the purposes of this section a person shall be taken to have shown that he was not in possession of a key to protected information at a particular time if— (a)sufficient evidence of that fact is adduced to raise an issue with respect to it; and (b)the contrary is not proved beyond a reasonable doubt.

... which makes me sad that misinformation is being used to fight a good cause.

> (and in that scenario it would be a lot easier to frame someone by simply writing some child porn).

Well, you'd have to get some child porn to frame someone that way. Random data is much easier to procure.

Sadly not by much.

It is several orders of magnitude easier to get random data: /dev/urandom.

Someone wanting to frame someone else is likely prepared to put in a lot of effort anyway.

There have been cases about this though and judges so far have not always bought this argument.

There was a case I read about where someoen was using full disk encryption. He said he gave police his password but it didn't work. The judge dismissed the charges because of the difficulty proving that the key produced wasn't correct but that the hard drive was not corrupt, among other things.

Yes, but the chances of proving such nebulous ideas change greatly if you can be demonized in the public eye.

That situation is really independent of the law. Imagine the law said that nobody could be compelled to decrypt data (using fourth amendment type reasoning), and it was leaked to the press that this person was suspected of traffic child porn, but refused to decrypt his harddrive - even when decrypting the harddrive could prove his innocence, wink wink nudge nudge.

I think refusing to decrypt a hard drive in the US is dependent on whether it is self-incrimination (5th Amendment) while police activities are more tied to the 4th Amendment.

But the point is "I gave you my password. I haven't seen the computer in a month while your forensic team was looking it over. Maybe I got it wrong, or maybe your boys screwed it up." That is not refusing to decrypt it. In fact it is very apparently cooperative.

I agree, and I definitely meant the fifth. But the GP talked about being demonized in the public eye - which doesn't rely on the law being one way or the other.

US courts have already ruled that the 5th ammendment does not apply to crypto keys. The court said that it was like requiring someone to hand over the keys to a container, etc.

US courts have split on the issue.

The argument isn't totally correct. The Police can't just make allegations and force you to surrender keys - they have to convince a judge that the allegations are true, and that getting the keys to your random noise will produce evidence.

RIPA is objectively flawed legislation, but it definitely doesn't "outlaw encryption" by anything less than a very long stretch of the imagination (as appears in this article).

>> they have to convince a judge that the allegations are true, and that getting the keys to your random noise will produce evidence

You are correct. However, suppose you encrypt some data and forget the key, or you store some radio noise in a file, or whatever.

Later, you are accused of a crime. The judge issues a warrant.

The data/noise is now evidence against you. You are presumed guilty, and it is impossible to prove your innocence.

No it's very easy. You claim the "key" is a one time pad, ie an XOR of the encrypted data - then you simply take the encrypted data and generate a "key" which XORs it into "the home secretary is a wonderful person and i support him"

So, perjury.

Not sure you can commit perjury if you are the accused !

In the US you can, and I'd be surprised if many other jurisdictions saw it differently. In the US you have a right against self incrimination, not a right to lie and misdirect. See Martha Stewart as an example, part of her conviction was making false statements to an investigator.

Martha "Stewart was found guilty in March 2004 of conspiracy, obstruction of an agency proceeding, and making false statements to federal investigator". The lying to investigators was most of her "crime". If she'd told them to talk to her lawyer and clammed up, she'd have been way ahead. The Feds never did prove securities fraud.

https://en.wikipedia.org/wiki/Martha_Stewart#Stock_trading_c...

Why do you make the jump here to "you are presumed guilty"? Your guilt would have to be proved in a court just like for any other crime.

Are you suggesting that the courts would somehow just believe, with no evidence, that it's encrypted data relevant to the case and you're wilfully withholding the keys?

You are not presumed guilty. But you are found guilty of breaking the new law which comes with a 5 year prison term if you were accused of being involved with terrorism or hiding child porn. Regardless of any evidence.

> You are not presumed guilty. But you are found guilty of breaking the new law ... Regardless of any evidence.

"Being found guilty... regardless of evidence" makes no sense. Part of 'being found guilty of breaking the law' involves the prosecution giving evidence that a jury thinks proves your guilt beyond reasonable doubt (inc. proving that you were in possession of a key, and so that it was actually encrypted data). s.53(3).

Your point is usually true, when the system is working as intended.

But it's not all that unusual for the gov't to really "have it in" for someone, but not be able to pin the crime on them, as with Al Capone.

In his case, the government didn't think it could pin the true charges on him, so he was actually convicted on tax charges. The tax code is big, obscure, and no expert agrees on the detailed interpretation, so it's not too hard to find some technicality that will convict anyone.

This encryption thing could easily be misused the same way: they can't prove you're a bad guy, so they trump up some technicality charges just to get you locked up.

Uk Judges are separate from the govenment.

You would ahve to go back to the bad old days of the star chamber to find the UK law system doing anything as doddgy as Al Capone (not exactly the USAs Legal systems finest hour)

>Uk Judges are separate from the govenment.

And how did that work out for the Guildford four for example?

http://en.wikipedia.org/wiki/Guildford_Four_and_Maguire_Seve...

Uk Judges are separate from the govenment.

In the UK, the term "government" refers to the executive branch. Outside that use, it encompasses the legislative, executive and judiciary power of a state. Wikipedia gives the following definition:

Government consists of the legislators, administrators, and arbitrators in the administrative bureaucracy who control a state at a given time, and the system by which they are organized.

Judges are part of that by definition, even if there's some separation from the other components.

No Judges are part of the "establishment" not the "govenment" ask Tony or Dave about the judges who ruled against them over a large number of issues.

I dubt wikipedia edited by a large number of Non UK People woud get the subtle destiction I am making here.

The term "government" has multiple meanings, but the most direct and common meaning is for the entire apparatus of state power, literally "the instrument which governs". This is true in all places that speak English, the United Kingdom included.

In the United States, we use the term "administration" to refer to an executive, his cabinet, and other associated officials. However, we still recognize the (not-so-subtle) distinction between the administration and the government as a whole; our government, as yours, is divided into three separate branches, and then again into many departments, agencies, committees, circuits, districts, and other subdivisions thereof.

Err the UK does not have a tripartate separation - there is a world out side of SV and the USA

The UK seems to have more crossover between legislative and executive functions, but the separation does exist, more or less. Parliament makes the laws. Various ministers execute the laws. The courts interpret the laws.

SV = El Salvador? South Vietnam?

I suppose you mean Silicon Valley, but I live on the East Coast (~3000 miles away). Also, our "tripartite separation" is based on yours, with the President taking the place of the Monarch/Prime Minister, the Congress taking the place of Parliament, and the Judiciary being roughly the same (we even use the same style of law, called common law, whereas most non-English-speaking countries use civil law).

Here in the USA we like to periodically hold witch hunts. That's how we got Martha Stewart, for example.

Martha Stewart is a witch?

I suppose that explains the eye of newt in the recipes.

Judges, police and the people who direct the police are all socially close coworkers for the most part.

Here in Brazil is guaranteed by the constitution that no one can be forced to produce any evidence against him/herself.

Isn't there something like this in the UK? You know... if someone says that you have ilegal encrypted data, they first would have to prove that it is really encrypted data and then that it is ilegal data.

There was a case where that defense was mounted, but failed [1]. The encryption keys were deemed to exist "separate from the will of the subject" i.e. they were deemed to be "physical". You can't use the defense against self-incrimination for physical keys either and the prosecution likened the encryption key to a physical key.

What hasn't been tested in court (afaik) is the refusal to hand over a passphrase that protects the encryption key. If the passphrase exists only in your head, it could be argued that it doesn't exist separate to your will.

[1] http://www.theregister.co.uk/2008/10/14/ripa_self_incriminat...

Is it illegal to hand over passwords yet if it's self-incriminating? Because encasing the encryption key in a passworded file could get you out. You would be providing the key, but wouldn't be self-incriminating yourself.

It would be like handing over an virtually unbreakable safe and saying "open it".

If you can write data to someone's hard drive it is simpler to just dump some child pornography.

OK, but suppose you're trying to frame them for bank fraud. Coming up with incriminating data is a lot trickier than just making it look like they have something.

Refusing to decrypt under this law will be the crime. It's not proof against you in the original charge. So you won't get them for bank fraud anyway, and then it might as well have been child porn (or a stash of stolen credit card number or compromised online banking accounts etc)

I'm a bit disturbed that you suggest it's easier dump child porn onto somebody's hard drive than it is to dump a random bitstream onto the drive. It implies you've got a huge cache of it hanging around ready to go.

Me too. Also, it's not "easier" even if you have it. To dump data, you have to have and transmit data; to dump noise, you just need a tiny script.

I think he's saying it's easier to dump unencrypted vs encrypted.

The point was that it doesn't have to be real data, just random data.

  > It implies you've got a huge cache of it hanging
  > around ready to go.

In the US at least, just a single image is illegal, so there is no need for a huge cache.

I imagine that a single image wouldn't quite motivate the police the same way that two gigabytes' worth would.

I remember a story about the FBI going after some college kid with a single thumbnail in his browser cache, though the other circumstances were:

- Somehow they came up with his IP in a sting where a link to a file was posted somewhere. I don't know if this was posted to a kiddie porn forum (or someplace where just hanging out there is enough to make you suspicious) or just someplace like 4chan (where there's a number of people that will click the link out of curiosity).

- He had 'recently' re-installed Windows. They claimed that he had obstructed justice (or some other B.S.) b/c he had destroyed evidence. (Evidence that they couldn't prove even existed, IIRC.)

- He had a single thumbnail of kiddie porn in a browser cache.

I think that he just settled with the Feds, but cases like this stick out in my mind because it makes it seem like we're all riding the razor's edge and could fall into the Federal justice system at any moment for some random, stupid reason.

[ Plus taking down a pedophile is brownie points to local politicians, which may (or may not) be pressuring them about crime statistics. ]

Let's just say it's not especially difficult to access on the darknet. (I've never done it myself, though)

And getting onto the darknet is but a simple download away...

He means simpler as in "simpler to get them locked up" rather than "simpler to execute." Having lots of child porn is a sure fire way to go to prison, whereas as has been demonstrated in this thread, the laws surrounding this entropy-of-doom attack are convoluted and highly suspect.

If you're caught though the consequences are terrible whilst encrypted Shakespeare given names to look like something illegal would only really have you under unauthorized access charges.

I don't know. I would think that attempting to frame someone with it shows some amount of malicious intent. There's got to be something else to charge them with other then the equivalent of "breaking and entering" to plant evidence.

viola-12-hot.zip looks tasty to a police officer who thinks they found illegal images but is just a keyword + title word + one-word review of a favourite play when you find the contents are Twelfth Night ... maybe?

But then you'd need to be in possession of it, and that has many issues that merely writing random data to a file does not.

Encrypted data, at least that encrypted with TrueCrypt, is distinguishable from random data. [1]

[1] http://superuser.com/questions/383526/is-a-normal-truecrypt-...

Says down below that it isn't: http://news.ycombinator.org/item?id=4234959

I'm very glad I'm wrong in this case! It would be a horrible weakness in TC.

My dark side is thinking of a virus, let's call it YouGoToJail, that encrypts a file (say with gunpg - 4mb and works on all OSes) with a random very long password. The virus then deletes all traces to itself. You go to jail!

It would be nice to see such a virus targeted at everyone in parliament.

Would the virus actually delete itself by writing over the data? If not, it would be possible to detect that the suspect had the virus.

And just before it deletes itself it posts threatening messages via your twitter and facebook account, designed to trigger the automated systems presumably watching these, thereby triggering an investigation into your affairs.

YouGoToJail indeed.

Well if you find yourself being asked for the encryption key for /dev/rand then you know things are pretty messed up. Given the technology intellegence of some law makers I do wonder when that day will come about.

actually when I read /dev/urandom I get a much larger stream of data. I think /dev/random is corrupted becuase it hangs after a bit when I try to read. So please hand over the key for /dev/urandom..... ;-)

It hangs because your system entropy pool runs dry.

Whoosh......

Isn’t it worse than that? Doesn’t it mean that, so long as you possess a reasonable amount of digital data, you could be hiding something in it and are therefore guilty.

Would be a valid defense argument for your lawyer to use. Lot of good that will do you in Gitmo (when the US implements this kind of law).

Guilty until proven innocent.

Reply on news.ycombinator.com