s/forget passphrase for/cause permanent destruction of/ , Re: Letwin wants increased penalties for refusal to decrypt

[Matthew Astley]

On Sun, Aug 18, 2002 at 08:22:20PM +0100, Peter Fairbrother wrote:
> Owen Lewis wrote:

> > Letwin should use a better speechwriter.
> > 
> > Fashion it thus.
> > 
> > Plod has (just about) sufficient evidence against X of drug
> > trafficking (or whatever gets you 30 years) to get a case before a
> > jury. The enciphered contents of X's PC, if disclosed, will turn
> > his 50:50 chance in front of a jury into zilch.

> [...] Your criminal could defeat conviction by just not writing down
> the encrypted information in the first place, or hiding the drive
> better.

How does encryption of data compare, legally, with irreversible[1]
destruction?

Would it be fair to say that pre-RIP they were mostly equivalent? The
data was encrypted, so a court could not read it. Game over.

The law is now being changed because TPTB wish to gain access to that
class of data, but the goalposts can be moved.


The route to irreversible destruction is still open, but it is more
expensive than encryption. There's the old story about pr0nographers
dropping their glass-plattered hard discs out of windows, and I'm told
that military installations have drives locked in a safe with an
explosive charge[2] attached.

Not only are the setup costs greater, the false alarm costs are pretty
significant too. Still, if you're running an illegal business then
presumably costs like these are part of the plan.


This covers stored data. Data in transit is covered, I believe, by
ephemeral keys: you show the court the source to your SSH
implementation, and explain that the session key is forever lost.

Therefore, the existence of seizure-proofed external drives could take
the focus of (the RIPA and its related debate) away from encryption
and perhaps point it more carefully where it belongs.


What should a jury read into the self-destruction of the accused's
data?

Was it caused by an alarm going off when the police broke the door
down?

Did it happen because the accused had been locked up for 24 hours and
not had a chance to "feed" it, so it "died of loneliness"?

What about if it died when the police entered a password which the
accused gave them?

What should a jury think, when informed that the accused possessed a
seizure-proofed device? (Surely only a criminal would use such a
thing!)

Oh, and a flippant one: how long before some criminal sues the police
for destruction of his data, when they break in and fail to find what
they're looking for?


Lots of questions. I'm not sure whether they're relevant, and I don't
have answers. My aim is to throw a spanner in the shark pool and see
what bites.

The thought was prompted by Peter's comment, and a pub conversation
about a chap who maintained "uptime" on his PC by carrying it and its
UPS between houses during two moves. (The corollary to the UPS thing
being that if you're paranoid you should have a wall between the UPS
and the computer, or better yet the charge in the safe.)


Matthew  #8-)
-- 
[1] Of course I mean "apparently irreversible". I presume the law
    understands the concept of criminals hiding copies of things, and
then omitting to mention the existence of these copies?

[2] I imagine there are ways of utterly destroying a disk without
    being done for possession of explosives.