RIPA Act

[Geoff]

http://news.zdnet.co.uk/0,39020330,39269746,00.htm

 

It's a stupid law. Part 3 will come into effect soon. It basically means you have to store all your private keys used in encryption. This includes fun things like your per session SSH, SSL and Kerberos keys. Even better are things like IPSec and Wifi WPA which rotate keys every few minutes. I can't begin to think of how we can comply with this law.

[kingswood]

Yes- this is one of the most stupid things to come out of blackhall in...ooooo...a week.

 

Just keep sending the WPA rotated keys to their server (or wherever) and have 10 dedicated access points just for that purpose. 10 from each school should keep them busy sifting through all your "private" data nicely...

 

I like how this equates the desire to have private (and by implication safer) email conversations and shared data traffic with terrorism and other nasties. Are these people for real? Next they will ban head scarfs because terrorists wear them. Tut.

 

:-(

[plexer]

Totally unworkable. If you use radius etc.. and have dynamic wpa keys then you don't know them anyway.

 

Ben

[ITWombat]

For some organisations there will be problems but schools shouldn't be that badly afftected. No-one in a school should be using any communiction channels that you don't have administrative control over except SSL webites for e-commerce or secure logins to Hotmail and the like. If you can't monitor communiction between wifi NIC and WAP then you can catch the suspect at the switch, web proxy, file or intranet server.

 

Because you work in a school you maybe able to insist on a lot mre control then in other orginsation. You're not running a cyber cafe with ad-hoc wifi hotpspots.

 

"The controversy here [lies in] seizing keys, not in forcing people to decrypt. The power to seize encryption keys is spooking big business,"

[PiqueABoo]

The "public consultation" document for the code of practice for RIPA part III is here:

 

http://www.homeoffice.gov.uk/documents/cons-2006-ripa-part3/

 

If you [want|dare] to comment you've got until the end of August (whether they pay any attention unless perhaps you represent some big corporate is anyone's guess). Lest you think these things are written by flawlesly clever folk you couldn't possibly surpass, here's a sample:

 

18. Where, in those specific circumstances, the person found guilty of the section 53 offence could show that the protected information did not contain an indecent photograph or pseudo-photograph of a child they could be liable to no more than a maximum term of two years.

 

IOW we won't send you to prison for *more* than two years for failing to decrypt some cryptogobbledygook, if you can prove a negative..

[russdev]

Well big borther time got email from home office today from Mr simon Watkin

 

No one is required to keep all their encryption keys - which is what Geoff seems to think.

 

The legislation means that where law enforcement acquire some protected data, most usually though the execution of a search warrant, they would be able - if they need to and it were appropriate and proportionate to do so - impose a requirement upon a person to disclose the protected data in an intelligible form or disclose the means of accessing the data and/or the means of putting the data in an intelligible form.

 

 

 

For the details, he should read the paper that your correspondent pointed him to: http://www.homeoffice.gov.uk/documents/cons-2006-ripa-part3/

 

 

 

What it also doesn't mean is that every encryption user should get into a flap over it anymore than every householder gets worked up that the police can kick your front door in or every driver gets worked up because they can take breath samples. The powers used properly, necessarily, proportionately and never unnecessarily or arbitrarily should not cause anyone any concern unless they are seeking to conceal evidence of their own or some else's criminal conduct.

 

 

As for your correspondent who writes "If you [want|dare] to comment you've got until the end of August (whether they pay any attention unless perhaps you represent some big corporate is anyone's guess).".....we want comments, that's why it's a public consultation, that's why we're interested to correct misimpressions about the point of the legislation.

 

Russell

[ico2]

Hmmm,

put protected electronic information into an intelligible form or to disclose a key which will enable the data to be put into an intelligible form

Sounds like: when they ask you, you have to either give them your key or decrypt it for them.

How long before a proper uprising against the uk govenment? Cant be long

[Geoff]

I think a revolution every now and then is a healthy thing.

[pete]

The powers used properly, necessarily, proportionately and never unnecessarily or arbitrarily should not cause anyone any concern unless they are seeking to conceal evidence of their own or some else's criminal conduct.

 

perhaps it _is_ the _manner_ in which these laws could applied be that concerns us? There's nothing like a quite like a government for creeping featuritus.

 

... and the second part of that sentence is the standard "if you've got nothing to hide" FUD. Defending your right to privacy <> criminality.

[kingswood]

The powers used properly, necessarily, proportionately and never unnecessarily or arbitrarily should not cause anyone any concern unless they are seeking to conceal evidence of their own or some else's criminal conduct.

 

perhaps it _is_ the _manner_ in which these laws could applied be that concerns us? There's nothing like a quite like a government for creeping featuritus.

 

... and the second part of that sentence is the standard "if you've got nothing to hide" FUD. Defending your right to privacy <> criminality.

 

I totally agree.

 

It's getting annoying listening to folk who argue for the dissolution of more and more privacy using the argument that "if you haven't got anything to hide don't worry". It's crap, that's what it is.

 

Paul

[kingswood]

"The powers used properly, necessarily, proportionately and never unnecessarily or arbitrarily should not cause anyone any concern....."

 

Yeah. Just like they always are ;-)

[TechMonkey]

It's getting annoying listening to folk who argue for the dissolution of more and more privacy using the argument that "if you haven't got anything to hide don't worry". It's crap, that's what it is.

 

Paul

 

Why? What have you got to hide

 

I think that was an OK argument for low level stuff, but its use is being pushed further and further now.

 

Next it will be "Full body cavity search as well as invasive medical searching. Why not? What have you got to hide!"

 

But I bet they still all get in next election. Either that or get peerages/sponsors on to think tanks and committies/a nice public paid holiday to do "diplomacy work."

 

I think governtmental work should be like jury duty. You get called up and forced to do it for normal wage and rubbish sandwiches. That'll make people think twice

[_Bob_]

What is strange and annoying to me is that I have never heard of anyone having equipment confiscated and then subsequently released because the powers that be were unable to decrypt enough incriminating data. Yet this silly argument was used to justify both RIPA and the governments attempts at extending their power to hold people without charge.

Ironic that they want to force us to show them everything in an 'intelligible form' when most of the stuff they spout is entirely unintelligible tosh.

[ico2]

Im waiting for them to upgrade my TV to a full telescreen!

[Geoff]

Time for one of those deep and meaningful quotes people tend to dust off in this sort of situation.

 

"Did you really think that we want those laws to be observed?" said Dr. Ferris. "We want them broken. You'd better get it straight that it's not a bunch of boy scouts you're up against - then you'll know that this is not the age for beautiful gestures. We're after power and we mean it. You fellows were pikers, but we know the real trick, and you'd better get wise to it. There's no way to rule innocent men. The only power any government has is the power to crack down on criminals. Well, when there aren't enough criminals, one makes them. One declares so many things to be a crime that it becomes impossible for men to live without breaking laws. Who wants a nation of law-abiding citizens' What's there in that for anyone? But just pass the kind of laws that can neither be observed nor enforced nor objectively interpreted - and you create a nation of law-breakers - and then you cash in on guilt. Now that's the system, Mr. Rearden, that's the game, and once you understand it, you'll be much easier to deal with."

 

- Ayn Rand, Atlas Shrugged, 1957.

[Geoff]

The BBC has run an article on RIPA.

 

http://news.bbc.co.uk/1/hi/technology/4794383.stm

[CyberNerd]

Definately flawed:

 

plausible deniability - http://www.truecrypt.org/docs/?s=plausible-deniability