Give us your password or go to jail!

http://www.bbc.co.uk/news/uk-england-11479831

Man jailed over computer password refusal

Oliver Drage was ordered to serve 16 weeks at a Young Offenders Institution on Monday
A teenager has been jailed for 16 weeks after he refused to give police the password to his computer.
Oliver Drage, 19, of Liverpool, was arrested in May 2009 by police tackling child sexual exploitation.
Police seized his computer but could not access material on it as it had a 50-character encryption password.
Drage was convicted of failing to disclose an encryption key in September. He was sentenced at Preston Crown Court on Monday.
Drage, was arrested when he was living in Freckleton, Lancashire, but later moved to Liverpool.
He was formally asked to disclose his password but failed to do so, which is an offence under the Regulation of Investigatory Powers Act 2000, police said.

Is the stuff on your computer worth going to jail for?

or more seriously do you have the right to privacy!

stepbar

Deleted User wrote: »

http://www.bbc.co.uk/news/uk-england-11479831

or more seriously do you have the right to privacy!

Not if you have kiddie porn on it you don't.... :mad:

Who the hell puts a 50-character encryption password on their PC unless they have something to hide?

Under A Funeral Moon

Good enough for the filthy b@stard.

ottostreet

no, for potential child porn cases, or suspected paedophiles, their computers should be accessible to police.

mikemac

16 weeks, he did the right thing....from a legal point of view

He probably knew full well if he gave the password he would be convicted of something a lot more serious.
Clearly he has something to hide

ottostreet

I would have thought that running the hard drive as a slave drive, on another system would allow access to data.


doesnt specify whether it was an operating system password, or drive password

holystungun9

Under A Funeral Moon wrote: »

Good enough for the filthy b@stard.

Suspect yes, but a little quick off the mark to label him as you have?

starbelgrade

holystungun9 wrote: »

Suspect yes, but a little quick off the mark to label him as you have?

Par for the course for the AH rabble.

tuxy

ottostreet wrote: »

I would have thought that running the hard drive as a slave drive, on another system would allow access to data.


doesnt specify whether it was an operating system password, or drive password

Sounds like 128 bit hard drive encryption, a OS password would be easy to bypass once you have physical access to the PC.

Under A Funeral Moon

holystungun9 wrote: »

Suspect yes, but a little quick off the mark to label him as you have?

If he had nothing to hide, he should have gave them the encryption password. Why else run the risk of going to prison? Serves him right. If he's found innocent in the future, I'll gladly take back my previous comment.

minidazzler

stepbar wrote: »

Not if you have kiddie porn on it you don't.... :mad:

Who the hell puts a 50-character encryption password on their PC unless they have something to hide?

ottostreet wrote: »

no, for potential child porn cases, or suspected paedophiles, their computers should be accessible to police.

OK then, I'm a cop, lads ye are suspected of having child pornography on your computer. What's your password?

Unless they have some pretty damning evidence, I would give noone access to my computer or my drives. The british police notoriously arrested thousands a few years ago because their credit card numbers showed up on a server in america where child porn was purchased, (over simplifying here), most had done nothing wrong at all, but they were still publicly arrested, you don't shake off accusations like that!

Under A Funeral Moon wrote: »

If he had nothing to hide, he should have gave them the encryption password. Why else run the risk of going to prison? Serves him right. If he's found innocent in the future, I'll gladly take back my previous comment.

That's the cop out that George Bush used for the Patriot act, innocent people have nothing to fear. I call bullsh1t! Innocent people have everything to fear these days!

Paddycrumlinman

ottostreet wrote: »

I would have thought that running the hard drive as a slave drive, on another system would allow access to data.


doesnt specify whether it was an operating system password, or drive password

That's what I was thinking but he may of had some software like lojack which encrypts the hard drive if removed.

Sanjuro

My password is passw.... oh shit!

ottostreet

ottostreet wrote: »

I would have thought that running the hard drive as a slave drive, on another system would allow access to data.


doesnt specify whether it was an operating system password, or drive password

Done a bit of PC forensics myself in the past, it's most likely that he used a whole disk encryption application.

There are many who rebel against this type of intrusion just to defend their right of privicy even if there is absolutly nothing incriminating there.

If there is any serious evidence to leading to him; re child porn, then that can be used instead of the refusal to provide a password.

In other words charge him with that crime and give him the opportunity to "open the PC" and clear himself or for be charged with withholding/destroying evidence.

minidazzler

Deleted User wrote: »

Done a bit of PC forensics myself in the past, it's most likely that he used a whole disk encryption application.

There are many who rebel against this type of intrusion just to defend their right of privicy even if there is absolutly nothing incriminating there.

If there is any serious evidence to leading to him; re child porn, then that can be used instead of the refusal to provide a password.

In other words charge him with that crime and give him the opportunity to "open the PC" and clear himself or for be charged with withholding/destroying evidence.

Is it not up to the cops to prove guilt? Simply not allowing access is not an admission of guilt, I wouldn't tell a cop my name if asked on the street when I was just going about my business. Never mind letting one look at my computer, I have nothing to hide, but just like my privacy!

CrazyRabbit

stepbar wrote: »

Who the hell puts a 50-character encryption password on their PC unless they have something to hide?

People who value their privacy. People who have sensitive business information. People who may have something that whilst not illegal, could be embarrassing or cost them their job/family etc. Hell, I use 20+ character encryption purely because I fear my PC & Laptop being stolen and information about me being used to steal my identity.

There are so many legally and morally right reasons for using encryption and maintaining privacy. It's your civil and human right to have privacy.

And I don't agree with forcing people to incriminate themselves in a potential crime. There are laws against this in many countries, and for good reason.

As for whether or not it's worth doing jail time by not handing over the password...well, that depends. If what's on the computer is illegal and could result in a 10 year prison sentence, then I guess it's better to stick with a few weeks in prison for not handing over the password.

minidazzler

minidazzler wrote: »

Is it not up to the cops to prove guilt? Simply not allowing access is not an admission of guilt, I wouldn't tell a cop my name if asked on the street when I was just going about my business. Never mind letting one look at my computer, I have nothing to hide, but just like my privacy!

Exactly! first rule of criminal law in the UK is "lnnocent untill proven guilty*".

*exceptions apply, unfortunately this list is growing!

Einhard

minidazzler wrote: »

Is it not up to the cops to prove guilt?

No, its not. It's up to a court, and a judge or a jury. People are over simplifying here. The police didn't kick his door down, ransack his house and terrorise him. They would have needed a warrant to gain access to his computer. The same as they would when entering someone's property. Why exactly should a computer be classified as more private than one's house, and therefore off limits to court sanctioned searches?

Jesus Wept

stepbar wrote: »

Not if you have kiddie porn on it you don't.... :mad:

Who the hell puts a 50-character encryption password on their PC unless they have something to hide?

It doesn't mean what they are hiding is illegal.
It'd be better if more people had 50-character encryptions than 'password1' and 'qwerty'.

limklad

tuxy wrote: »

Sounds like 128 bit hard drive encryption, a OS password would be easy to bypass once you have physical access to the PC.

Windows users passwords are easy to crack in less than a minute once you have access to the computer and the right software which is freely available.

btard

The-Rigger wrote: »

It doesn't mean what they are hiding is illegal.
It'd be better if more people had 50-character encryptions than 'password1' and 'qwerty'.

Omg. How did you find out my password? :eek:

minidazzler

Einhard wrote: »

No, its not. It's up to a court, and a judge or a jury. People are over simplifying here. The police didn't kick his door down, ransack his house and terrorise him. They would have needed a warrant to gain access to his computer. The same as they would when entering someone's property. Why exactly should a computer be classified as more private than one's house, and therefore off limits to court sanctioned searches?

It's up to cops and prosecutors to PROVE guilt. It's up to Judge and jury to decide if the person is guilty.

I don't think that a computer should be more private, but it's getting very easy for the police to get warrants for computers.

IP addresses aren't good sources for probable cause I think, they can be spoofed fairly easy these days!

I would love to know what evidence the police had in this particular investigation.

mikom

At a guess.......... Llanfairpwllgwyngyllgogerychwyrndrobwllllantysiliogogogoch

58 letters though.

limklad

Deleted User wrote: »

http://www.bbc.co.uk/news/uk-england-11479831



Is the stuff on your computer worth going to jail for?

or more seriously do you have the right to privacy!

Identity Thief and Yes you do have a right to Privacy.

I have heard some members of the Gardai laughing about x, y and Z who were neighbours of mine and were not been investigated just because one original tenant in the house is a bad egg and they use that information about what in their Rented house in order to embarrass others to give information about the suspect that they knew very little about. They should be charged for breach of privacy of others not related to the case. It is a major problem when the Gardai enters a rent house shared by number of different Tenants who were strangers to each other. The original Tenant was been investigated before they move in. They been in the house 2 weeks when their stuff was taken by the Gardai. They took computers from everybody even though they had the warrant for one individual computer belonging to the original tenant and publicly (loud verbally) release information about one person sexuality and sexual bondage habits when he discovered items in a drawer who was not involved in any crime to embarrass information out of him about the reclusive original Tenant. The Gardai then suggested loudly that the others were also involved in child bondage sex games also within earshot of their new neighbours.

minion35

CrazyRabbit wrote: »

People who value their privacy. People who have sensitive business information. People who may have something that whilst not illegal, could be embarrassing or cost them their job/family etc. Hell, I use 20+ character encryption purely because I fear my PC & Laptop being stolen and information about me being used to steal my identity.

There are so many legally and morally right reasons for using encryption and maintaining privacy. It's your civil and human right to have privacy.

And I don't agree with forcing people to incriminate themselves in a potential crime. There are laws against this in many countries, and for good reason.

As for whether or not it's worth doing jail time by not handing over the password...well, that depends. If what's on the computer is illegal and could result in a 10 year prison sentence, then I guess it's better to stick with a few weeks in prison for not handing over the password.

If the banking sector took note and improved encryption on their laptops it would help a lot. Although I would be a supporter of privacy to a certain extent if their is a criminal matter such as child porn full authority must be given to the police.

minidazzler

minion35 wrote: »

If the banking sector took note and improved encryption on their laptops it would help a lot. Although I would be a supporter of privacy to a certain extent if their is a criminal matter such as child porn full authority must be given to the police.

Yeah, but that means that police can say they are looking for child porn on anyones computer. There have been huge blunders before for that sort of thing, I wouldn't like police seizing my computers under that pretence because people will believe it and then when I am proven innocent, they won't recall that fact, only that I had my computers taken for kiddie porn!

SugarHigh

minidazzler wrote: »

Yeah, but that means that police can say they are looking for child porn on anyones computer. There have been huge blunders before for that sort of thing, I wouldn't like police seizing my computers under that pretence because people will believe it and then when I am proven innocent, they won't recall that fact, only that I had my computers taken for kiddie porn!

Exactly it also wouldn't be hard for them to charge you for kiddy porn because what is actually considering porn in Ireland is surprising. I've heard that any women dressed up to appear underage is also illegal so that would include any porn where an adult wears a school uniform.

fergalr

The responses of some of the posters here are terrifying.

Under A Funeral Moon wrote: »

Good enough for the filthy b@stard.
...
If he had nothing to hide, he should have gave them the encryption password. Why else run the risk of going to prison? Serves him right. If he's found innocent in the future, I'll gladly take back my previous comment.

Hey, you don't mind if the police put cameras in your bedroom and shower, do you? We've no evidence, but we think you might be committing a crime.

If you disagree, we'll jail you. But I presume you won't object if you are innocent. After all, why run the risk of going to prision?


Anyway, if you object to it, you are clearly a 'filthy b@stard'. (If you are found innocent in future, I'll gladly take back my previous comment).

...

I don't know whether this guy is innocent or guilty, but we should presume innocence. Maybe they guy is just paranoid about privacy. Some people are. Maybe he's gay and thinks being gay is a terrible thing (some people are pretty mixed up,or have strange beliefs), and doesn't want anyone to know what he has written in his diary. Maybe he has some other secret he wants to keep private that is in no way criminal, but he just doesn't want anyone to know.
You don't know these things...

Amalgam

stepbar wrote: »

Not if you have kiddie porn on it you don't.... :mad:

Who the hell puts a 50-character encryption password on their PC unless they have something to hide?

Rented accomodation with lousy security.

Quite probably using: http://www.truecrypt.org/

KevinVonSpiel

Look, it's not like the authorities would ever use this law to suppress/oppress anyone.

We're talking about the UK here, for G_d's sake!

pwd

limklad wrote: »

Windows users passwords are easy to crack in less than a minute once you have access to the computer and the right software which is freely available.

The only software you need is Windows itself

FruitLover

On the one hand:

As mentioned previously in the thread, privacy is a basic human (and civil) right and bleating about someone having 'something to hide' simply because they choose to exercise this right is ignorant and short-sighted. I bet everyone in this thread who has noted the use of computer encryption as 'suspicious' still locks the door when they're taking a dump, or closes the blinds/curtains when they're drying after a shower.

On the other:

Police don't just randomly raid people's houses on suspicions of child abuse, and if they have been granted a warrant to search the house based on reasonable suspicion, I think they should be able to search the computer as well, considering this is a likely source of evidence. Preventing this (e.g. by withholding an encryption key or password) could reasonably considered obstruction of justice.

Manic Moran

Here's the question I've not seen answered: Was there a legal justification for the search of the hard drive? i.e. was there a warrant out?

If so, then the obstruction or refusal could be validly a jailable offence.

The issue has been in the courts a few times in the US, the jury is still sortof out on whether or not compelling a person to reveal his password is a violation of the Fifth. The caselaw is still being fine-tuned, but the nutshell is that 'You have the right to remain silent, with a few exceptions you may not be aware of if you've not paid attention to the wider caselaw relating to the 5th'

NTM

old_aussie

Deleted User wrote: »

Is the stuff on your computer worth going to jail for?

If you don't want to wear the tag of pedofile for the rest of your life.

old_aussie

pwd wrote: »

The only software you need is Windows itself

You must know very little about encrypted password protection.

Overheal

mikom wrote: »

At a guess.......... Llanfairpwllgwyngyllgogerychwyrndrobwllllantysiliogogogoch

58 letters though.

I would have presumed something easier to remember like H0w4r3j00g3ntl3m3n477urb453rb370ng2us, or something to that effect.

Overheal

Manic Moran wrote: »

Here's the question I've not seen answered: Was there a legal justification for the search of the hard drive? i.e. was there a warrant out?

If so, then the obstruction or refusal could be validly a jailable offence.

The issue has been in the courts a few times in the US, the jury is still sortof out on whether or not compelling a person to reveal his password is a violation of the Fifth. The caselaw is still being fine-tuned, but the nutshell is that 'You have the right to remain silent, with a few exceptions you may not be aware of if you've not paid attention to the wider caselaw relating to the 5th'

NTM

I was about to raise the same point but the article cites an english act of 2000 about investigatory powers. Im not exactly up to scratch on british criminal law.

Dravokivich

minidazzler wrote: »

Unless they have some pretty damning evidence

From the article...

was arrested in May 2009 by police tackling child sexual exploitation.

I think they may have had evidence linking him to people who trafficed such data, or even possibly a direct complaint from someone he may have been harrassing.

Police can't act on this kind of thing without a warrant.

This was not a fúcking whim...

CreepingDeath

Amalgam wrote: »

Quite probably using: http://www.truecrypt.org/

Yeah, the FBI weren't able to crack TrueCrypt. News Link

I use it on my USB drives in case I lose them... I don't want a lot of personal & work related documents falling into the wrong hands.

Cavehill Red

Under A Funeral Moon wrote: »

If he had nothing to hide, he should have gave them the encryption password. Why else run the risk of going to prison? Serves him right. If he's found innocent in the future, I'll gladly take back my previous comment.

Er, he IS innocent. Innocent until proven guilty.
The only thing he has been found guilty of is not giving the police his computer password. Unless you do believe that privacy is a criminal act?

CreepingDeath

Cavehill Red wrote: »

Er, he IS innocent. Innocent until proven guilty.
The only thing he has been found guilty of is not giving the police his computer password. Unless you do believe that privacy is a criminal act?

True.
Not giving out the password is the equivalent of the right to silence.

enda1

CreepingDeath wrote: »

True.
Not giving out the password is the equivalent of the right to silence.

Maybe,

though its more like if the police have a warrant to search your house and you then pour about 5 metres of concrete over and all around it. Leaving one door which is nuclear bomb proof - and don't give them the key.

Cavehill Red

enda1 wrote: »

Maybe,

though its more like if the police have a warrant to search your house and you then pour about 5 metres of concrete over and all around it. Leaving one door which is nuclear bomb proof - and don't give them the key.

Er, no it isn't.

stepbar

stepbar wrote: »

Not if you have kiddie porn on it you don't.... :mad:

Who the hell puts a 50-character encryption password on their PC unless they have something to hide?

Wtf kind of cr@p is this?
Why do you have a lock on your door if you have nothing to hide?
Why do you wear clothes if you have nothing to hide?
Why don't you disclose your salary and bank details to every man on the street if you have nothing to hide?

I hate this stupid ridiculous "if you have nothing to hide you don't mind sharing every intimate detail with everyone".
Fair fcuks to the kid standing up and not giving his password.
Even if he was hiding something, it's good on principle.

nudist

CreepingDeath wrote: »

Yeah, the FBI weren't able to crack TrueCrypt. News Link

I use it on my USB drives in case I lose them... I don't want a lot of personal & work related documents falling into the wrong hands.

I use truecrypt as well-tell me what is the best way to remember passwords? using acronyms i can remember 12-14 symbols but that is too short for a password these days.

For more sensitive data you could obviously store the password on a encrypted usb disk but then you have to remember the password for the usb key as well then.

Oh and by the way my username is 'nudist' but its just that- a username i picked cos it was free. I do wear clothes :pac:

28064212

bluewolf wrote: »

Wtf kind of cr@p is this?
Why do you have a lock on your door if you have nothing to hide?

If the Gardaí have a valid warrant for my house, I don't lock it to them

bluewolf wrote: »

Why do you wear clothes if you have nothing to hide?

If the Gardaí have reason to believe I'm hiding something on my person, I strip down

bluewolf wrote: »

Why don't you disclose your salary and bank details to every man on the street if you have nothing to hide?

If the Gardaí have evidence I'm in posession of money I shouldn't have, I give them my salary details to account for it

bluewolf wrote: »

I hate this stupid ridiculous "if you have nothing to hide you don't mind sharing every intimate detail with everyone".
Fair fcuks to the kid standing up and not giving his password.
Even if he was hiding something, it's good on principle.

There is a huge difference between "sharing every intimate detail with everyone" and disclosing legally relevant information to society's law-keepers. Assuming that the police in this case had a warrant, they had to have enough evidence to convince a magistrate that there was cause to seize his computer. This wasn't a random search. Here is the warrant-issuing guidelines. There are a number of criteria which needs to be met.

To the posters disagreeing with the suspect being forced to give up his password, what would be the correct course of action in the following scenario: A suspected arms dealer is arrested and a warrant is issued to search his home, where there is believed to be a weapons shipment. The police search the home, finding nothing, except for a walk-in safe which they can't access. Should the suspect be required to give up access to the safe?

An entirely separate issue that people seem to be bringing into the discussion is the responsibilities of the Gardaí in regard to private legal information. If the police find a load of (legal) BDSM porn on his computer, they have no right to discuss that or make it public knowledge. If they do, they can be sued and face expulsion from the force. If the suspect in this case has confidential, personal or sensitive (legal) information on his computer, the police are bound by law to respect the privacy of what they found.

28064212

28064212 wrote: »

There is a huge difference between "sharing every intimate detail with everyone" and disclosing legally relevant information to society's law-keepers..

There's another huge difference between the latter and "Who the hell puts a 50-character encryption password on their PC unless they have something to hide?"

28064212

bluewolf wrote: »

There's another huge difference between the latter and "Who the hell puts a 50-character encryption password on their PC unless they have something to hide?"

Sorry, I misread and assumed your implication was that he shouldn't be forced to give up his password.

Do you think he should be required to give the police his password?

seamus

In case anyone is imagining an insanely complicated password, remember that space is a character too.
A simple phrase or sentence, such as "According to Douglas Adams, the meaning of life is 42" weighs in at 53 characters and assuming that it's not a direct quote would be next to impossible to crack. Because it's a sentence, it's much easier to type in correctly.

Though if you leave your PC and lock it every five minutes I'm sure it would become a nightmare over time. But even a simple phrase of twenty characters or so would be super-strong and easy to type in.

fergalr

28064212 wrote: »

An entirely separate issue that people seem to be bringing into the discussion is the responsibilities of the Gardaí in regard to private legal information. If the police find a load of (legal) BDSM porn on his computer, they have no right to discuss that or make it public knowledge. If they do, they can be sued and face expulsion from the force. If the suspect in this case has confidential, personal or sensitive (legal) information on his computer, the police are bound by law to respect the privacy of what they found.

First off, its not specifically the Gardai that are being discussed in this thread, its a UK case.

From from the current case, it seems that if they are just investigating you for having child porn, they can just tell this to the press and get you tarred with the same 'guilty until proven innocent' brush used here, with little respect for what a police accusation like that will do.

Separately, police leak strategically useful stuff all the time. You are naive if you think otherwise, there are frequent examples if this.

In the example you gave, if you start complaining about them frivolously forcing you to disclose your password, you might soon see a newspaper report disclosing that BDSM porn you didn't want to come out.

JohnK

28064212 wrote: »

There is a huge difference between "sharing every intimate detail with everyone" and disclosing legally relevant information to society's law-keepers.

Bull****! People store every tiny little detail about their lives on their computers these days so giving a password is giving the police every tiny little detail about your life and in the event you work for yourself like I do then it also gives every little detail about your job and loads of confidential client information.