CovOps
 Location : Ether-Sphere
Job/hobbies : Irrationality Exterminator
Humor : Über Serious
 |  Subject: U.K. Prepares to Imprison Encryption Passphrase Refuseniks  Sun Aug 30, 2009 7:39 am | |
| Encryption is a powerful privacy and security tool. It is absolutely essential to our modern way of life.
Every time you use your credit card, the merchant that accepts it transmits the data on its magnetic strip in encrypted form to a processing center for approval. A similar process occurs when you log on to your online bank or securities account. Indeed, without encryption, hackers and identity thieves would shut down the Internet and the banking system within a matter of hours.
However, governments have a love-hate relationship with encryption. This is particularly true with encryption technologies that permit individuals—as opposed to governments, banks, and businesses—to take back a smidgen of the privacy rights they've been systematically stripped up in recent decades.
For instance, I've long recommended encrypting all confidential files on your PC. This converts plain-text files on your PC into unreadable gibberish. Programs like PGP Desktop (http://www.pgp.com) that automatically encrypt your entire hard disk are even better.
It's no accident, though, that the inventor of PGP—a programmer named Phil Zimmermann—almost went to jail in the 1990s for the "crime" of distributing software empowering individuals to protect their privacy. And ever since, governments worldwide have been doing their best to "control" personal encryption technologies.
A U.K. law called the Regulation of Investigatory Powers Act (RIPA) is a case in point. A section of the RIPA that came into force in 2007 allows U.K. police to demand encryption keys or provide a clear text transcript of encrypted text. Failure to comply can result in up to two years imprisonment for cases not involving national security, or five years for terrorism offenses and the like. Police can order you to turn over data months or even years old.
Surely, police have reserved this draconian sanction for known associates of Osama bin Laden, or in investigations of similarly severe threats. But that's not how it's been used. Instead, as I described in an earlier blog post, the first known use of this authority came against an animal rights activist.
Now, the U.K.'s "Chief Surveillance Commissioner" (how's that for an Orwellian job title?) has disclosed that two defendants--apparently not including the animal rights activist--have been convicted for failing to hand over their encryption keys. Both are now awaiting sentencing by the courts. The cases of five other defendants accused of the same "crime" apparently remain before the courts.
I suspect that officials in other countries—especially the United States—are nodding in approval of this process. Under U.S. law, the Fifth Amendment to the Constitution protects individuals from being forced to incriminate themselves. However, in a few cases, U.S. courts have already ordered individuals suspected of possession of child pornography to release their encryption passphrases.
What will you do when jackbooted thugs arrive at your home or business, seize your encrypted computer files, and demand that you give them unrestricted access to all of them? Are you prepared to go to jail to protect your privacy?
I don't have a good answer to these questions. But you can bet I'm thinking of them.
If you have any ideas, I invite you to share them—my blog is now open to comments.
http://nestmannblog.sovereignsociety.com/2009/08/uk-prepares-to-imprison-encryption-passphrase-refuseniks.html |
|
