Yes RIPA does. The discussions on the legal blogs focused on the
viability of presenting any 'forgotten' defence. (Notwithstanding
medical evidence of a memory disorder). Those discussions questioned
any ability to be able to maintain an effective 'sorry I have
forgotten' defence. They should be available via a search using factors
contained in the link provided. (Having been focusing on financial and
academic worlds over the last year I did not myself save all the
links.)
One has to accept the juries findings could probably be based
upon softer information available within the courtroom. One of the odd
things is that I myself deliberately do put in a password intending not
to remember it when occasionally finally closing electronic accounts
down, and I also forgot some passwords when first obtaining and
learning how to use PGP and utilising long passwords. (I found memory
management differs between long and short passwords) So it is difficult
to believe I am the only person who follows such a practice or has
experienced that type of forgetfulness.
Any other responses from the
list will be interesting as the questions remain valid.
I do find it
interesting that nobody has yet raised the issue of access to a persons
passwords not being acceptable because of the levels of access that
provides, or that other access mechanisms are generally available. (To
enable legal procedures only requires read access.) All of which leaves
open the interpretation that passwords, whilst being a part of
security, are being perceived as more of an accountability mechanism
than a security one. (I am deliberately disregarding situations where
they may be widely shared anyway.)
For info, if it is useful to
anybody, this case does provide a particularly good case study
illustrating many different facets of the privacy paradigm.
Ian W
-----Original Message-----
From: Andrew Cormack [mailto:Andrew.
[log in to unmask]]
Sent: 05 January 2011 17:43
To: Ian Welton; data-
[log in to unmask]
Subject: RE: Passwords question
Ian
RIPA
part III definitely allows forgetfulness as a defence (s53(3)). However
the blog suggests that the question in this case was actually whether
it was plausible that someone would use such an unmemorable password
(40-50 *random* characters, the blog suggests) and not write it down.
The jury appear to have concluded that it wasn’t plausible, therefore
there must be a written copy somewhere that the defendant was refusing
to disclose. So the defendant failed to "adduce sufficient evidence to
raise an issue" of whether he was still in possession of the (written)
password.
There are ways of generating memorable passwords of that
length that don't need to be written down (the passphrase for my
digital signature is of that order), but using a random number
generator doesn't seem to be one of them.
Andrew
--
Andrew Cormack,
Chief Regulatory Adviser, JANET(UK)
Lumen House, Library Avenue,
Harwell, Didcot. OX11 0SG UK
Phone: +44 (0) 1235 822302
Blog: http://webmedia.company.ja.net/edlabblogs/regulatory-developments/
JANET, the UK's education and research network
JANET(UK) is a
trading name of The JNT Association, a company limited by guarantee
which is registered in England under No. 2881024 and whose Registered
Office is at Lumen House, Library Avenue, Harwell Science and
Innovation Campus, Didcot, Oxfordshire. OX11 0SG
> -----Original
Message-----
> From: This list is for those interested in Data
Protection issues
> [mailto:[log in to unmask]] On Behalf
Of Ian Welton
> Sent: 05 January 2011 17:11
> To: data-
[log in to unmask]
> Subject: Re: Passwords question
>
> The
issue started as a discussion over ethical reporting and the
> ethics
of organisational press releases, so most of the
>
coverage/discussions pertained to those areas, with legal blogs also
>
debating if forgetfulness could be an acceptable defence.
>
> It was
conjectured that
> some of the issue for the courts was the strength of
encryption.
>
> A
> reasonably full media write up was:-
> http://www.newstatesman.com/blogs/the-staggers/2010/10/police-drage-
> password-sex
>
> A Happy New Year to all.
>
> Ian W
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
All archives of messages are stored permanently and are
available to the world wide web community at large at
http://www.jiscmail.ac.uk/lists/data-protection.html
If you wish to leave this list please send the command
leave data-protection to [log in to unmask]
All user commands can be found at http://www.jiscmail.ac.uk/help/commandref.htm
Any queries about sending or receiving messages please send to the list owner
[log in to unmask]
Full help Desk - please email [log in to unmask] describing your needs
To receive these emails in HTML format send the command:
SET data-protection HTML to [log in to unmask]
(all commands go to [log in to unmask] not the list please)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
