UK outlawed encryption

There was some surprise in the comments of yesterday’s post over the fact that the United Kingdom has effectively outlawed encryption: the UK will send its citizens to jail for up to five years if they cannot produce the key to an encrypted data set.

First of all, references – the law is here. You will be sent to jail for refusing to give up encryption keys, regardless of whether you have them or not. Five years of jail if it’s a terrorism investigation (or child porn, apparently), two years otherwise. It’s fascinating – there are four excuses that keep coming back for every single dismantling of democracy. It’s terrorism, child porn, file sharing, and organized crime. You cannot fight these by dismantling civil liberties – they’re just used as convenient excuses.

We knew that this was the next step in the cat-and-mouse game over privacy, right? It starts with the government believing they have a right to interfere into any one of your seven privacies if they want to and find it practical. The next step, of course, is that the citizens protect themselves from snooping – at which point some bureaucrat will confuse the government’s ability to snoop on citizen’s lives for a right to snoop on citizen’s lives at any time, and create harsh punishments for any citizens who try to keep a shred of their privacy. This is not a remotely dystopic scenario; as we see, it has already happened in the UK.

But it’s worse than that. Much worse. You’re not going to be sent to jail for refusal to give up encryption keys. You’re going to be sent to jail for an inability to unlock something that the police think is encrypted. Yes, this is where the hairs rise on our arms: if you have a recorded file with radio noise from the local telescope that you use for generation of random numbers, and the police asks you to produce the decryption key to show them the three documents inside the encrypted container that your radio noise looks like, you will be sent to jail for up to five years for your inability to produce the imagined documents.

A 32-gigabyte noise file, or encrypted data? Can only be the latter.

But wait – it gets worse still.

The next step in the cat-and-mouse game over privacy is to use steganographic methods to hide the fact that something is encrypted at all. You can easily hide long messages in high-resolution photos today, just to take one example: they will not appear to contain an encrypted message in the first place, but will just look like a regular photo until decoded and decrypted with the proper key. But of course, the government and police are aware of steganographic methods, and know that pretty much any innocent-looking dataset can be used as a container for encrypted data.

So imagine your reaction when the police confiscate your entire collection of vacation photos, claim that your vacation photos contain hidden encrypted messages (which they don’t), and sends you off to jail for five years for being unable to supply the decryption key?

This is not some dystopic pipe dream. This law already exists in the United Kingdom – and the vacation photo scenario above, while on the far-fetched side of the scale, is possible. And the basic philosophical problem is greater than the described collateral damage: the government will send you to jail for safeguarding any confidences placed in you.Source

World's Largest Organization for Computer Professionals Comes Out Against CISPA

The US Public Policy Council of the Association of Computing Machinery (ACM), representing ACM, came out against CISPA, the cybersecurity legislation recently passed by the US House. ACM is the world’s largest organization for computer professionals. They are joining a diverse group of individuals and organizations opposing this bill, including a wide array of digital civil liberties organizations like EFF, computer scientists like Bruce Schneier and Tim Berners-Lee, and companies like the Mozilla Foundation.

CISPA is intended to protect America against cyberthreats, but destroys core privacy protections by providing vague definitions and unfettered access to personal communications by companies and government agencies. In one such example, ACM criticized the expansive definition for “cyberthreat information,” which could “encompass everything from port scans to destruction of entire networks.” We agree, and voiced identical concerns when CISPA was first released.

Vague definitions are accompanied by a vague standard for companies to make “reasonable efforts to limit the impact on privacy.” Though the standard is well intended, ACM correctly identifies that the vague standard “fails to invoke any framework, standards, oversight, or controls to be used” for personal information. They also conclude that the bill creates “no meaningful support for collection minimization” and shares information that “could have nothing to do with cybersecurity”—problems that we have consistently highlighted in our commentary on CISPA. These large gaps in privacy protections highlight some of the core shortfalls we have voiced about CISPA.

Digital civil liberties groups, companies, and computer researchers are glad ACM joined the opposition to CISPA. The upcoming bills in the Senate share many similarities to CISPA and must be stopped. This is the reason why we vow to take the fight to the Senate, ask you to sign our petition against the Cyberspying Bills, and tweet your Congressmen.

June 6, 2012
PDF HERE