Youth jailed for not handing over encryption password

ghost filing

real encrypted data is disguised I bet.

If I was bin laden, and I needed to send out my secret instructions or whatever...

I would, were I doing it, for instance, take something like

mp3 or jpeg encryption, and in the lsb parts put my data in.

Then the secret files could only be extracted by the right software

with the correct password.

This type of data hiding would be transparent.

Here the file in clear. Yes its some Hungarian nose flute music. Why don't you like

Hungarian nose flute music ????

Scary

Sure hope he used a very high grade encryption algorithm!

www.be-anon.net.tc

Hmmmm

While I think a law like this is wrong, I can't help thinking that if I were under criminal investigation on child sex charges and I had an encrypted volume which I knew I could unencrypt and prove beyond any doubt that I didn't have any child porn on there then I would run from my moral highground and decrypt my drive quicker than anything rather than be tainted by the paedo brush, so unless his defence is "I forgot the password" you have to question why he won't decrypt it...

I'f I make a recording of static

then how can anyone prove that is not an encrypted file?

Or for that matter any file - what looks like a list of phone numbers could in fact be an index for a bomb making recipe that refers to pages/chapters in a certain book.

I'm sure if you keep trying to decrypt almost any file for long enough you can generate anything from child porn to, god forbid, a Steps CD.

You can only truly prove a file is encrypted if you did it yourself.

Double trouble

In reality he can't be convicted twice for the same offence, but he can be convicted for committing the same offence twice.

The most likely action is that the judge will him for the password and return him to jail for contempt until he relents.

Many journalists have been jailed for contempt for refusing to name sources but the courts always give up in the end.

He was arrested 17 months ago

May 2009, so the police have already had 17 months to break the password. It looks like it must have been a good one.

The full story / more details...

From: Lancashire evening post: http://www.lep.co.uk/news/teen_locked_up_after_failing_to_give_police_computer_code_1_1811470

Teen locked up after failing to give police computer code

Published on Wed Oct 06 08:27:54 BST 2010

A teenager has been sentenced to 16 weeks in a young offender’s institution after withholding his computer password from police.

Oliver Drage, 19, told the jury at Preston Crown Court he had “forgotten” the password, when officers investigating another offence asked him to surrender it.

However, the jury found him guilty of failing to disclose the password when he was lawfully required to do so.

Drage’s computer was seized in May last year. But by December police still did not have access to it.

Janet Ironfield, defending, said it was not known whether the computer was subsequently sent off to an expert bureau for analysis or whether it had simply sat on a shelf throughout the seven month period.

She added: “This man lost a great deal by the fact the police came to arrest him.

“He lost his reputation in the community.”

She said Drage, formerly of Naze Lane, Freckleton, now of Westminster Road, Liverpool, had moved house to avoid bringing shame on his family and had lost his job.

Judge Heather Lloyd said: “This was a deliberate flouting of a court order compounded by your continual denial of guilt.”

-----------------------------------------------------

With these stories tech magazine only seem to get just some details, but not all.

So the two worrying things about this particular case....

First is that he tried the 'I have forgotten the password...' defense and the jury still found him guilty.

Second is that this was a jury case just to decide about whether he was guilty under the RIPA law. So a jury of his peers gave the RIPA law the thumbs up. According to some reports taking only 15 mins to think about it. This is the most worrying thing to me. Just because a government put's in a law I disagree with does not mean that I will support it by finding someone guilty of it when on a jury. To me even though he is guilty to the letter of this law, if the law this is stupid then he is not guilty.

Why do I not support this law, because in the way it is put together there is potential that it will put in prison people who are otherwise innocent (just because you don't give up a password does not mean 100%, you have another crime you are covering up). I will never support a law like this even if it means some guilty people get away.

With law's, you can make them so that they guarantee that all guilty people will go to jail, but to do so you have to sacrifice some innocent people into prison as well. To me, laws that are made should guarantee that no innocent person goes to prison even if it means that some guilty people escape as well. But I am sure other people think differently including this jury.

I also find it interesting that when looking for more news on this through Google news search, the amount of non English places reporting this. Another reason British people cannot hold their heads high in the world any more....

Was it really photographs of child abuse?

It quite likely was not. The law in this area is so incredibly vague, and so much wider than most people imagine, that it may have been nothing more than a photograph of a nude toddler playing on the beach. However due to the secrecy inherent in this legislation we just have to take the word of the people in the "justice" system. People who make a career out of using, or sometimes abusing, this law.

A law which is badly defined and almost invariably described as being much narrower that it actually is makes a travesty of justice.

Increasingly we can not trust the authorities when they describe someone as a paedophile because they were convicted of having child porongraphy. It is quite likely that it was not pornographic.

It is also likely that the convicted person assumed that legislation described as applying to pornography only applied to pornography. There is no way to distinguish between people who genuinely possessed child pornography and use the lack of clarity as a smokescreen to minimise their culpability and those convicted of posessing non-pornographic photrographs who genuinely thought that they were legal.

It is a complete mess and far too much of my time is wasted on trying to minimise the harm caused but legislatve failings that could easily be fixed.

Damned if you do...

Think of this as being like other laws. For example, if you are stopped by the police on suspicion of drink driving you can refuse to provide a sample for testing, but if you do you can (and usually will) be prosecuted for refusal to provide a sample.

Quite why they need something specific for this under RIPA I don't know, surely it's just like any other case of withholding evidence.

Now just imagine..

.. you forget your password. It's happened to me, and the file may still be around. Congratulations, you just got yourself a ticket to jail..

Surely "forgotten" is the best defence?

Forgotten is the accused word against the police. If the accused was previously of good character, forgotten simply reduces guilt/innocence to a 50/50 bet. I good defence lawyer should be able to argue effectively that a probability of 0.5 is an awful lot of reasonable doubt........

One option ...

I believe a few people have missed something. RIPA doesn't actually require you to hand over the password, but it does require you to make the data available in unencrypted form. So it would be legal for you to enter the password for them rather than hand it over.

However ...

How about putting the password on the same drive, in plain view - but not marked as being a password. Or on a piece of paper in plain view but also not obviously a password.

Plod takes computer, asks for password, you tell them that you do not have the password and it is in their possession - but you give them no further information as to where in all the seized stuff (papers and computers) it is.

When asked, your answer is simply :

The password was not memorable and written down, it is probably in amongst materials you have seized. It is therefore no longer in my possession, and you (the Police) are in possession of all information you need to read the files.

If it was written on a piece of paper, then all you would be able to tell them would be "it was in the pile on my <insert description> shelf". Chances are, in their process of seizing paperwork, they won't be able to associate that description with any single large bag of paper now in their possession.

In my case, I could tell them "it was on my desk" - and I could be quite certain they wouldn't know which bit of paper it was even if I told them "immediately to the right of where I put my laptop".

But like others, I could also be in trouble because, like others, I'm in IT and I often make up temporary passwords - /dev/urandom is a good source. I may write it down, or put it in a text editor window that doesn't get saved. Once the job is done, there is no record of the password. If i miss a file when cleaning up, then I'm screwed.

Adult/Child?

Whats the adult age over thar?

So ...

This guy had a 50 char password, and the jury did not believe that he could have forgotten it.

Wtf?

Child Porn

Wow, I have never seen so many people defend someone who was found downloading child porn..

While I do not subscribe to the idea that the state should control every aspect of our lives, I also dont subscribe to the idea that some pervert should be allowed to encrypt his illegal porn just to keep it from being used as evidence.

If I was to kill and chop up someone, cook them in a stir-fry and serve them up at my local chinease resturant.. Does that exclude me from being charged with murder?

Re:so

"This guy had a 50 char password, and the jury did not believe that he could have forgotten it.

Wtf?"

it's simple, they believe the password is on a sticky note some were, after all thats what they would of done.

Forgotten passwords

Look at it this way: An encrypted file with a last accessed timestamp a few hours prior to the PC being impounded and the password requested (and no evidence that the date is incorrect) would likely dissuade a jury from accepting a plea of "I forgot the password".

However a protected zipfile from 2 years ago (again with no evidence of date based shennanigans) would probably be accepted as forgotten.

Although it is legally plausible that a person can be jailed for refusing to provide a password and then on release from prison have the password re-requested and a new jail sentence passed only a rabid anti-establishment conspiracy theorist would actually believe that would happen.

I am not a fan of this legislation, not by a long straw, but some of the armagedon scenarios posted here are not worthy of anyone who has the intelligence to use a computer