Subject: RE: [Raven] BBC Online 10/2/2000: "Surveillance bill under fire"

From: [email-masked]
Date: Fri, 11 Feb 2000 10:46:03 +0200

> The prosecution must show that the person "has or has had" 
> possession of the key, but if you are claiming it has been 
> lost or forgotten, naturally that is conceded. If you do 
> claim it is lost or forgotten (or inaccessible), you
> can't just leave it at that, because the burden falls on you 
> to PROVE that in order to establish your defence.

 - Have they though about how exactly can one prove that he/she
has forgotten/lost some security token (e.g. password/phrase/key)?
 "Give us your passphrase."
 "Sorry, but I don't remember it."
 "Prove that!"
 "Err... you see.. err... I've just forgotten it.."

> If nothing at all is said (that can be used in evidence)...I 
> guess they DO have to show that the person has or has had 
> possession of they key (beyond reasonable doubt). Interesting - 
> that was not so in the July 99 E-Comms Bill.

 - That one is interesting too. If the LE can't decrypt your data
(i.e. they have no access to the key/knowledge of it), how can they 
prove that the key ever existed in the first place. You can always
claim that the file/communication was just garbage, and when they 
ask e.g. about some magic cookies or crypto signalling IEs that were 
present in your file/communication you can always act stupid and
claim that you have no knowledge of what you computer/terminal 
does behind your back...
Eh?

 Just my few cents,
Janne Haikonen

_______________________________________________
raven mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/raven

---

From: Fred Baker <[email-masked]>
Date: Fri, 11 Feb 2000 17:40:22 -0800

At 10:46 AM 2/11/00 +0200, [email-masked] wrote:
>You can always

I think that would last about 9 milliseconds in the presence of a competent
lawyer. Let's see, you're paying how much every month for the privilege of
sending someone else something neither you nor they know or can use the
contens of? Why are you doing that? Doesn't doing so constitute some form
of denial of service attack which may itself be punishable?