RE: [Raven] BBC Online 10/2/2000: "Surveillance bill under fire"

> The prosecution must show that the person "has or has had" 
> possession of the key, but if you are claiming it has been 
> lost or forgotten, naturally that is conceded. If you do 
> claim it is lost or forgotten (or inaccessible), you
> can't just leave it at that, because the burden falls on you 
> to PROVE that in order to establish your defence.

 - Have they though about how exactly can one prove that he/she
has forgotten/lost some security token (e.g. password/phrase/key)?
 "Give us your passphrase."
 "Sorry, but I don't remember it."
 "Prove that!"
 "Err... you see.. err... I've just forgotten it.."

> If nothing at all is said (that can be used in evidence)...I 
> guess they DO have to show that the person has or has had 
> possession of they key (beyond reasonable doubt). Interesting - 
> that was not so in the July 99 E-Comms Bill.

 - That one is interesting too. If the LE can't decrypt your data
(i.e. they have no access to the key/knowledge of it), how can they 
prove that the key ever existed in the first place. You can always
claim that the file/communication was just garbage, and when they 
ask e.g. about some magic cookies or crypto signalling IEs that were 
present in your file/communication you can always act stupid and
claim that you have no knowledge of what you computer/terminal 
does behind your back...
Eh?

 Just my few cents,
Janne Haikonen

_______________________________________________
raven mailing list
raven@ietf.org
http://www.ietf.org/mailman/listinfo/raven