Hacker News Reader

Comment by digitalengineer | Hacker News Reader

He chose his passwords well it seemed: $ur4ht4ub4h8 It's not entirely impossible to forget that is it? How are you tp prove you did in fact not forget it?

View on HN

Given the password is relatively simple - remember this is supposed to be one of the premier encryption cracking organizations in the world, GCHQ, here - I think there is a distinct lack of skill (or absence) by GCHQ. He's perhaps being jailed for showing them up.

Alternatively (and more likely I suspect), these is some gamesmanship being played to get shiny new additional super-snooping laws passed because it's needed to cope with all this uncrackable terrorist encryption. See, here's the proof it exists ! [edit: sorry, this did not make it clear I'm suggesting it was cracked but found to be irrelevant to the terrorism case. I've expanded in a reply below.]

The UK already has laws making it an offence to have 'have information' 'which may be of use to anyone planning a terrorist offence'. This is so broadly defined that railway enthusiast pictures of trains could fall into it (and have been questioned under it - http://www.telegraph.co.uk/news/uknews/road-and-rail-transpo...)

The UK's unwritten constitution is not worth the paper it's written on. Unfortunately the US written one seems to be about as useful in protecting peoples rights these days as the UK one. (See previous HN stories of your choice)

GCHQ giving the password is problematic when the case goes to court.

GCHQ have considerable computing power. That probably has weird costings. Thus the cost of 48 hours to run this task is possibly costed at some huge amount that police forces cannot afford unless they know it is a significant target with a spectacular result.

Standard Operating Procedure is to say it was handed to the Metropolitan specialist computer crimes unit who cracked it. Someone turns up in court saying they are a Met officer from the unit and they worked really really hard. It's never been a problem.

Remember this was originally a terrorist case; there would have been plenty of resources made available - there always are for these.

A likely scenario is it was cracked and found to be irrelevant so the option of going for a political angle for more powers was much more preferable than letting some low-level frauster know his encryption had been cracked (and hence letting lots of people know the USB encryption was worthless and risking real terrorist cases where suspects used the same approach).

It's a 12 characters passowd, for most crypto algorithms, it's slightly bigger than what one can crack with his GPU in a sane amount of time. They didn't spend that much.

Perhaps GCHQ had cracked it, got any info they could (in this case, nothing terrorist related), and then returned it feigning they couldn't crack it. That's what I'd do.

It's more likely that they spent a couple of hours, figured it was not worthy of more time (hey, lots of crypto to crack, these days they scan the whole internet after all!) and returned it to Plod. There was enough proof to incriminate him already.

> 'have information' 'which may be of use to anyone planning a terrorist offence'

Just wow! Does that include engineering books?

In Australia, even if you have forgotten it, they'll just jail you for contempt anyway.

How are you tp prove you did in fact not forget it?

Under the Regulation of Investigatory Powers Act 2000[1] it doesn't matter whether you forgot a password or not. Failure to provide it is against the law.

This Act has proved highly controversial for a number of reasons. The potential for fitting someone up by claiming that they aren't disclosing a password that in reality they can't disclose was one of the civil liberties concerns expressed even before the Act was passed.

[1] https://en.wikipedia.org/wiki/Regulation_of_Investigatory_Po...

Reply on news.ycombinator.com