Man facing rare refusal-to-unlock-encryption charge: Court date set A 20-year-old Brit will appear before magistrates in Maidstone, Kent, on 20 December charged with launching denial-of-service attacks on the websites of Kent Police and Oxford and Cambridge Universities. Lewys Martin, from Walmer near Dover in Kent, also faces charges of theft of personal data and failure to disclose passwords …
The answer to that quandry is to take legal advice on whether or not you should answer their questions.
The advice is likely to be "don't say anything" and then in court you say: I didn't give this explanation when questioned because my legal advice was that I should't answer the question.
That's a good enough reason to not have answered it.
This post has been deleted by its author
It is all a bit of a mess. You should have a right to silence, to a fair trial and not be forced to incriminate yourself, courtesy of the ECHR. However, the Criminal Justice and Public Order Act 1994 changed things. Now, a court is allowed to infer intent or guilt from a refusal to answer police questions - but this varies according to whether or not the accused has had legal advice. I guess the answer is to tell the pigs that you will be happy to answer their questions,once you have had legal advice - whereupon they will leave you locked up for many hours and tell you that they cannot find your lawyer, in the hope that you will get bored and talk to them.
The issue with passwords, encryption keys, etc. has been added with the Regulation of Investigatory Powers Act - and a court of appeal has ruled that the right to silence and the right to not be forced to incriminate oneself don't apply as any password or encryption key is not incriminating information in itself.
"You understand it wrong."
Citation, please.
From Wikipedia:
The Criminal Justice and Public Order Act 1994 provides statutory rules under which adverse inferences may be drawn from silence.
Adverse inferences may be drawn in certain circumstances where before or on being charged, the accused:
o fails to mention any fact which he later relies upon and which in the circumstances at the time the accused could reasonably be expected to mention;
o fails to give evidence at trial or answer any question;
o fails to account on arrest for objects, substances or marks on his person, clothing or footwear, in his possession, or in the place where he is arrested; or
o fails to account on arrest for his presence at a place.
That's not much of a right to silence is it? It's a bit like saying "You have the right to hold your breath indefinitely". You do have such a right, but you're going to be rather screwed if you exercise it.
When arrested in England and Wales, the arresting officer will read you your rights and (s)he will say something like:
"You have the right to remain silent, but it may harm your defence if you do not mention, when questioned, something which you later rely on in court. Anything you do say may be given in evidence."
This I'd imagine then gets superseded by further laws that I presume state things like "You must provide decryption keys when requested for the collection of evidence" (which I don't agree with personally).
So yes, we do roughly speaking have the right to remain silent until that is removed by another law depending on your case. I don't think a court will convict anyone who stays silent when asked "did you kill Testy McTest?" for example.
> Its an EU human right o remain silent under police questioning
Yes, but the law in England and Wales permits a court to infer bad things about you should you choose to exercise that right. Hence the newer version of the caution :-
"You do not have to say anything, but it may harm your defence if you do not mention when questioned something which you later rely on in court."
So it's all very well having a right to silence, but you stand a good chance of getting yourself locked up for it. Not really much of a right...
Vic.
The problem with saying that you were advised by your lawyer to remain silent is that you've waived your attorney-client privilege over that part of your advice, meaning that your lawyer can be compelled to confirm/deny that he (or she) gave the advice.
1. It was then, and it is now
2. It wasn't this government
3. He is a terrorist. And a criminal. And a thief (tried to steal data, I'm sure). Violating private networks makes him a rapist too. And a traitor, as he betrayed the trust of this loving country. Give him 25 years, then deport to Scotland, or some such wild territory.
I supposes they could call him a Cyber Terrorist? just be glad uncle sam didn't get hold of him, much worse fates will await him...
The problem is not that they can demand encryption keys, but that you don't know what they will do with your data afterwards...
What if you have pictures on your HDD of your family, some of them are of your kids running round the house nude, or your wife sunbathing topless, or even more risque photos of your wife.... Photos you planned to keep for yourselves, hence the encryption.. Can you get compensation for invasion of privacy? what if one of those photos appeared online afterwards? will they compensate you?
@AC 07:46 - You're making an absurd point - It's not suggested that we allow authorities to rifle through our private files on the off chance. What is happening here is that someone is being compelled to hand over passwords for encrypted files which are the subject of a court issued search warrant into a criminal investigation. Were I to withhold a key to a safe, in a similar situation, I would be held in contempt of court and could be imprisoned.
You're making an equally absurd point.
If you've lost the key then the authorities are compelled to either use physical force to open the safe or search your property to find the key.
If you lose or forget a password on encryption key, then the assumption is that you're actually refusing to give them the information because, as we all know, people never forget passwords. You may be in a position where you genuinely have nothing to hide but are completely unable to prove it and get sent to prison as a result.
Feel better?
And also about bloody mindedness.
No, I would NOT let self-appointed 'authorities' nose through my hard drives.
I confirm to you good people that there is nothing more secret on it than my monthly budget and Christmas shopping list. But why the hell should any government - local, national or plod - decide they have the right to see it?
They don't - they can sod off. And to their acolytes I say "No I've got nothing to hide, but my private affairs are just that". "Private!" "Now kindly Foxtrot Oscar".
OK.....
Even under RIP, you can tell plod you have "forgotten" your pass-phrase and there isn't too much they or a jury can infer.
By saying to plod "I'm not telling" he is either making a stand to get RIP struck down (and has very big, hairy balls indeed), or he is a bit thick and has had crap legal advice.
Prace bets now.
A third option would be to deny that the block of data is encrypted at all.
You'd hope that something that was encrypted properly would appear as just a series of random bytes. Before the police start demanding passwords, shouldn't they first be required to produce evidence that there is, in fact, something there to decrypt?
As luck would have it, a decent encryption regime would mean that the only way to distinguish the difference (from random bytes) would be to decrypt it in the suspicious data first place. Only _then_ would there be something that you could be legally required to hand over the password for. But of course, by then the topic is moot.
Good luck.
The encryption is done with software, which is on the disk.
Unless he was using an external boot disk (and lets be honest, so far the hackers in the news don't appear to be all that ;)) then the software for decrypting is clearly visible on the disk before the encrypted data.
> shouldn't they first be required to produce evidence that there is, in fact, something there to decrypt?
They should be. They aren't.
A Section 49 notice only requires belief "on reasonable grounds" that there is an encrypted data block. And it doesn't need to be Plod issuing the notice - it can be anyone in Schedule 2.
Note that 49(3) gives the grounds on which a Section 49 notice can be issued. The first is the one I find least troubling. The grounds are :-
(a)in the interests of national security;
(b)for the purpose of preventing or detecting crime; or
(c)in the interests of the economic well-being of the United Kingdom.
(c) above should worry any foreign nationals storing commercially-sensitive data in the UK...
Vic.
>> shouldn't they first be required to produce evidence that there is, in fact, something there to decrypt?
>They should be. They aren't.
>A Section 49 notice only requires belief "on reasonable grounds" that there is an encrypted data block. And it doesn't need to be Plod issuing the notice - it can be anyone in Schedule 2.
Which is worrying in itself. Usually it's not the responsibility of the accused to prove that a crime has been committed. The police are the ones who have to produce (or at least suspect) that a law has been broken. Once they've done that, they proceed to collect evidence and if there's enough, the CPS will make a decision to prosecute. I suppose it could be argued that providing a password is part of the interrogation process and just like perverting the course of justice, lying about not knowing a password (or having forgotten it) is a bit naughty. But to be required to provide a password when there's no proof that one even exists sounds like a policeman requiring ordinary citizens to 'fess up to any crimes they may (and the presumption being that they did) have committed at any point in the past - even if there's no proof that the person has committed any.
Yes, he should have just given them a "password" instead of making a stand as judges dont like having the piss taken with the law. Jurys tend not too either.
"But of course its that PASSWORD" (give them your online bank account password) "its my online bank account password, my super secret one! What do you mean it doesnt work?"
Then your job to the jury is just convincing them you have forgotten it under duress of possibly getting 10 years. Here is a list of all the passwords ive used for email, bank, voicemail etc.
Obviously perjury is bad. Anal sex under 18 is illegal, do not infringe copyright, shooting dwarves with crossbows in chester is *still* murder even though you wont break any by-laws. etc etc
You do realise that telling plod you "forgot" your password still counts as "failing to disclose the password" under the RIPA legislation.
Under RIPA if an encrypted file is found on your system and you cannot decrypt it you face jail time and no amount of arguing will save you.
" You do realise that telling plod you "forgot" your password still counts as "failing to disclose the password" under the RIPA legislation. "
My understanding is that there has never been a prosecution for 'forgetting' a password.
There have only been prosecutions for outright refusal.
If you can find a reference otherwise, I am very willing to be proven wrong.
I'd suggest that the courts know that trying to prosecute somebody for forgetting something is a potential minefield. Maybe even enough to call the act into question.
Passwords are supposed to be complicated, which can make them difficult to remember.
If you show plod your email account with all the emails received after using "I've forgotten my password" to get a link to reset yet another forgotten password, when does "I've forgotten it" become a reasonable excuse?
I've just had to reset my password here (again) to be able to log in....
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
