Security services trying to get password from hacker 'through back door'

Updated

British security services have been accused of potentially dealing a blow to privacy by attempting to force an alleged cyber hacker to hand over the password to his encrypted computer files.

Lauri Love, 31, is fighting attempts to extradite him to America to face criminal charges for breaking into Federal Reserve computers.

He is accused of stealing "massive quantities" of sensitive data resulting in millions of dollars of losses and faces up to 12 years in prison in the US if he is found guilty.

Officers from the National Crime Agency (NCA) launched an investigation and raided his family home in Stradishall, Suffolk, in October 2013 where they seized encrypted computers and hard drives.

No charges were brought in Britain against Love, but the NCA wants him to hand over his passwords so officers can check the data before the electronics are returned.

Love's team say the application, if granted, would be a significant blow to privacy and amounts to a "power grab" by the security services.

Love, the son of a reverend, said the six bits of encrypted hardware being held contain his entire digital life.

Speaking outside the court, he said: "They are holding my property to ransom.

"It is not just the devices that cost money and I don't have a lot of money, but it is everything I have ever made - writings, software, photos, correspondence, memories of an inestimable personal sentimental value."

But the NCA argues that screenshots taken of the computers before the encryption kicked in shows that Love had information from Nasa, the US military and the department of energy.

Love, who walked into court wearing a woollen bear hat and clutching a copy of Saving Gary McKinnon, is suing the NCA for the return of his computers and hard drives under the Police Property Act.

Stephen Cragg QC, representing Love, told London's Westminster Magistrates Court: "This case raises the question, should a person who is seeking the return of his computer equipment that has been seized by police be forced to reveal the content of the data on the computer before the equipment is returned?

"Mr Love says it raises questions in respect to the right to respect for a private life and right to enjoyment of private property."

He said that the NCA should apply to a court under the controversial Regulation of Investigatory Powers Act (Ripa) to force people to hand over their passwords to decrypt data.

Mr Cragg added: "There is a concern that the NCA is seeking in this application to access Mr Love's data by the back door rather than by the route sanctioned by Parliament in Ripa."

Strict safeguards exist to ensure Ripa is only used when certain circumstances exist, the court heard.

By asking a judge to make the order in a civil case without making a Ripa application, the NCA is "in effect making a power grab that will place a question mark over the legality of encryption in the UK", Mr Love's supporters warn.

The police did issue Love with a Ripa order in February 2014, which he did not comply with. It expired with no further consequences.

Advertisement