Belfast Telegraph

UK Website Of The Year

Home News UK

Security services trying to get password from hacker 'through back door'

Published 12/04/2016

British security services have been accused of potentially dealing a blow to privacy by attempting to force an alleged cyber hacker to hand over the password to his encrypted computer files.

Lauri Love, 31, is fighting attempts to extradite him to America to face criminal charges for breaking into Federal Reserve computers.

He is accused of stealing "massive quantities" of sensitive data resulting in millions of dollars of losses and faces up to 12 years in prison in the US if he is found guilty.

Officers from the National Crime Agency (NCA) launched an investigation and raided his family home in Stradishall, Suffolk, in October 2013 where they seized encrypted computers and hard drives.

No charges were brought in Britain against Love, but the NCA wants him to hand over his passwords so officers can check the data before the electronics are returned.

Love's team say the application, if granted, would be a significant blow to privacy and amounts to a "power grab" by the security services.

Love, the son of a reverend, said the six bits of encrypted hardware being held contain his entire digital life.

Speaking outside the court, he said: "They are holding my property to ransom.

"It is not just the devices that cost money and I don't have a lot of money, but it is everything I have ever made - writings, software, photos, correspondence, memories of an inestimable personal sentimental value."

But the NCA argues that screenshots taken of the computers before the encryption kicked in shows that Love had information from Nasa, the US military and the department of energy.

Love, who walked into court wearing a woollen bear hat and clutching a copy of Saving Gary McKinnon, is suing the NCA for the return of his computers and hard drives under the Police Property Act.

Stephen Cragg QC, representing Love, told London's Westminster Magistrates Court: "This case raises the question, should a person who is seeking the return of his computer equipment that has been seized by police be forced to reveal the content of the data on the computer before the equipment is returned?

"Mr Love says it raises questions in respect to the right to respect for a private life and right to enjoyment of private property."

He said that the NCA should apply to a court under the controversial Regulation of Investigatory Powers Act (Ripa) to force people to hand over their passwords to decrypt data.

Mr Cragg added: "There is a concern that the NCA is seeking in this application to access Mr Love's data by the back door rather than by the route sanctioned by Parliament in Ripa."

Strict safeguards exist to ensure Ripa is only used when certain circumstances exist, the court heard.

By asking a judge to make the order in a civil case without making a Ripa application, the NCA is "in effect making a power grab that will place a question mark over the legality of encryption in the UK", Mr Love's supporters warn.

The police did issue Love with a Ripa order in February 2014, which he did not comply with. It expired with no further consequences.

Mr Cragg said he was objecting to the application on several grounds.

He argued that it "effectively circumvents" Ripa, breaches Love's Article 8 right to privacy under the Human Rights Act, and warned that Love should not have to "run the risk of incriminating himself potentially" by having the data disclosed.

He added: "It is disproportionate because it is not necessary for the court to decide this case."

Raising his hand to interject, Love said: "The NCA has failed to establish that there was encrypted data on the device in the first place."

The NCA said the encryption keys and passwords should be handed over so police can check if the data belongs to Love.

Ben Keith, representing the NCA, said: "When they executed the search warrant at least one of the computers was open and screenshots were taken. One shows a full directory from a US department including of all the employee records."

He said Love's computers also had material from the department of energy, Nasa, the US military, and the Police Oracle website used by law enforcement officers to discuss policing.

He had also illegally downloaded films and music, the court heard.

Mr Keith said: "We feel there is clear evidence that there is likely to be significant amounts of data that Mr Love does not own and should not have access to, and has been obtained illegally."

District Judge Nina Tempia reserved judgment until May 10 at Westminster Magistrates' Court.

WikiLeaks founder and Courage Trustee Julian Assange said: "The UK is already one of the worst jurisdictions in the world in which to practise the basic human right to privacy, but it may be about to get even worse.

"In the case of Lauri Love, the National Crime Agency is making a grab for even more police powers. If it succeeds, anyone who uses encryption will be considered suspect under the law - a breathtaking reversal of the presumption of innocence.

"Lauri Love is fighting this case for the rights of all UK residents against excessive and abusive policing. Because the UK is a laboratory for these kinds of repressive policies, the case will also have wide-reaching repercussions internationally. Love must prevail."

Read More

From Belfast Telegraph