This case is troubling on so many levels it's difficult to even say.

First of all, I happen to have used ~50 character passwords for quite a bit, ones with a combination of familiar words bound together with no logical connection to a stranger, but which for me are connected. And like the name I used above, it is fairly easy to come up with a logic for substituting letters for numbers where appropriate in "l337" style (check that from wikipedia, if you don't know it).

Second, what is more troubling, is that there is no plausible evidence connecting this poor kid to anything like CP or CSE. You could have said something like "server logs that suggest" or something. It is obvious the coppers have no real evidence, and that they wanted to look for anything incriminating on the disk drive.

Third, this is an illustration of how RIPA made a travesty of reasonable privacy. Damn it, I would NOT have given that password,and I would have made it very clear in court and press why not. Because it is an outrageous invasion of privacy! If you have some server logs, etc then it's a shame on me, but then even those server logs can only be suggestive. IP sppfing is not as hard as one might like to think.

Fourth, another way coppers abuse their power. It could be that they just wanted to check for any good porn on this guy's computer, and tried to make him divulge his whole life to them, even stuff that has nothing to do with any crime, but that could be used against him. Isn't anyone thinking of that? They went as far as subpoena for the password, and threaten with jail, and then they had to come up with something, and sure enough, they cough up the magic words: "Child Porn" or "Child Sexual Exploitation" and here we are.

Even if this case had developed from this stage, the coppers have abused their powers, and you sheeple are praying for more powers for them, right? You want someone to protect you from the freedom that it took almost a thousand years to acquire, and now you want to destroy it because you're afraid of guys who look different and might be dangerous.

Sorry for the rant, this case just set me off again (I may have commented earlier here, I can't remember, honestly!).

To be incarcerated for four months for just this? Bizarre. Sounds like an hysterical witch trial from the fifteenth century. Where is the any other evidence?

This case is an absolute disgrace. How on earth did they prove beyond a reasonable doubt that he had not, in fact, forgotten his password? Or is that no longer a requirement to secure a conviction in the UK any longer?

@MP Could you prove the claim that there was 'only 1 reason why he wouldn't divulge the necessary details.'? The fact is that there are numerous examples of Police falsely accusing people of such offences on the most flimsy of evidence. Child Pornography cases have become modern-day witch-hunts. All it takes is a suggestion that someone is engaged in such activity for the bumbling masses to reach for their pitchforks.

The Police and Judge in this case are the real criminals. They clearly are so used to perverting the so-called justice system that they can so brazenly behave in such an underhanded and manipulative fashion.

British justice is a joke.

I honestly, in my (thankfully) computer illiterate bubble, thought that any computers content could be retrieved in the event of these kind of circumstances. Clearly not. Back to my love of beastiality then..

If Drage had a 40-50 character password, it would be reasonable to assume that he couldn't remember it and had to rely on a note somewhere.

If he had destroyed this aide memoire *before* the police formally asked for the password, it is very unlikely that he could have been convicted under RIPA.

If you call an innocent person a sex offender in a press release without privilege or fair comment defence it's libel. If you merely say it over the phone it's slander. Very poor practice, naive and culpable, by the press officer concerned.

I develop web sites and one of the first things required in just about every one I've ever built is a "forgotten password?" option. Most sites have them, becuase, quite simply, they are used. By us. People that don't have 50 character passwords, but more "normal" length ones... Yes, that's right, we even forget our 8 character passwords that we once used. I certainly have.

Are 50 character passwords accepted many places?

This is all indefensable. The Police and the CPS should have waited until they could crack the encryption and gain the correct evidence, then charged him with the relevant offense or offences. Without evidence to prove without doubt, the person who is "suspected of committing a crime" is innocent until there is evidence to prove that the accused person is guilty.

I would also like to point out that a person has the right to privacy. Any invasion of that right, by the Police, had better be for a good reason, other wise we are no longer living in a democracy.

@bernie court,
Yes it's a silly law but that's not relevant to anything else you've mentioned. We're not talking about a Windows password here. It's an encrypted drive. Copying any data will only give you encrypted data. What you're talking about is purely a password to access Windows and your drive is not encrypted. A 40 key encryption will NOT be cracked at all (certainly with modern tech) if any modern encryption method was used.

I'm Spartacus

Easy solution. Find out his dog's [ pet's ] name.

Duh Vinci

I'm part of a UK police computer forensics unit, and have been following this case with some interest (and the comments on most tech news sites with rather less interest). First off, a disclaimer: I'm not from Lancashire Police and have no knowledge whatsoever of this case other than what I've read in the press.

You say that we don't have the full picture and I think you're absolutely right. The PR from Lancs is incomplete, which is pretty much expected - a police force is not a news agency, and shouldn't be treated as such either by itself or by the press. Its releases should be treated, in my opinion, as merely a heads-up for journalists that there might be a story of interest. The work in developing the story is down to the journalists, although these days many seem to be content with merely printing a PR verbatim. This isn't the fault of the police but I accept that nor does it excuse the police for releasing skewed statements.

Should the police have released the details of the nature of the offence for which Drage was arrested? I think the answer to that depends on whether or not the information could have been obtained from the Courts - if it could, then it's public record and a proper journalist would have discovered it with a couple of phone calls anyway. As the nature of the original offence affects the sentence with Section 49, I would imagine that the details would have been prominent..

We've had several cases where a suspect has been using strong encryption and has been initially reluctant to provide the password. So far we've been lucky in that we've always had a mass of evidence to indicate that the encrypted data was being regularly opened, up until shortly before the arrest. We can also usually show folder listings of the encrypted data which. in the indecent images cases. give a fair indication of the contents. Was any evidence like this provided in the Drage case? We don't know but presumably it's in the public record. if it was part of the evidence sent to CPS - remember that everything. the prosecution does is disclosable.
y
A final point - where is Drage's solicitor in all this? I may be mistaken, but all of the information so far seems to have come from the prosecution at the request of the press. If I were Drage and I had genuinely forgotten my password, I'd be making damn sure that my good name wasn't left in the hands of a random lawyer-journalist who happened to take an interest in the case.

So yes, we don't have the full picture. But is it the job of the police to keep the press informed of their every move? Should every file that goes to CPS also go to Reuters?

Maybe someone said it, but you all realize that the "TEEN" was capitalized because, like many other publications, they tend to put in all caps the first part of the article. This is a common thing, not as if they capitalized "TEEN" in the middle of the article. It's a style thing.

he is 19yo. if he touched his 17yo girlfriend and her dad went to police, he can be charged as sex offender.
his gf can be forced to be checked by a doctor and when he enters prison he will have to strip in front of the officers.
tell me what is more intrusive?

Is there a difference between not providing a password and not providing a breath, urine or blood test to the Police for driving?

---
@polleetickle
Twitter.com

@Quirk

You alluded to suspicion.

More importantly, when does suspicion evolve to a breach of legislation.

Most countries won't allow suspicion as a precedence to home invasion.

Do you drive a tank through the front wall of said premises based on suspicion alone?.Or do you accept that the owner of the property has every right to protect their personal autonomy & well-being in life?.

What I totally do not understand is that every ISP can and does log what an IP address downloads. Why can't they find out that way? Even going through a proxy server they can still find out.

Also, what ever happened to the right of personal information to be keep personal ?

Seems very heavy handed to ruib this kids life by how they have prosecuted him - turned him into a sexual predator without actual proof wtf.....

For an encryption to be affective you would need it on the root of the hard drive - unless he wrote his own software then any encryption manufacturers will have a 'back door' or a means to recover. If he's encrypted a folder then what about the rest o the stuff on his computer where information can be found like history, temp files, system files, registry ? I find it hard to believe this kid can comprehensively protect his machine that even the MOD / CID type specials can'#t even gather data from.
In fact, I think this kid is a scapeogoat and is being made an example to scare the public - the government want to be in total control
I smell a rat.

3 words - New World Order

Encryption requires that you type a certain number of characters before becoming secure. It could be a password or a sentence created with alphnumeric, special characters such as a tilde and mixed case.

All publically available encryption is monitored by governements after all they are years ahead in this field. Companies such as microsoft have to enable backdoors into their encryption to provide support for law enforcement.

The Police and CPS are both lazy in not using a brute force password charachter

People are too self obsessed about privacy in this me me me society if he had nothing to hide why play games with his own integrity its a joke that he claims he forgot his password and as likely as thugs when in court for violence remembering nothing of the event

I think the main article raises some interesting issues, but it's not of much help in relation to the offence itself since, as others have pointed out, there are many 'known unknowns', such as how much co-operation Drage gave to the police.

One group of people who do know these details is the jury that convicted him. They reached their decision in 15 minutes, which suggests that they didn't have many doubts about their verdict. They heard the evidence in the case (including evidence from Drage himself if he chose to give it), and know more about the case than we do.

Yet people in the comments above seem to pile on the police, CPS and judge but very little mention of the jury. One commenter does raise the issue of 'Jury nullification' - which is when a jury reaches a verdict contrary to the weight of the evidence.

I presume this was a satirical comment since we don't know what the weight of the evidence was, but the jury did.

I should add that I don't have any difficulty in principle with strong sanctions being available for failure to disclose passwords or the like in certain circumstances.

This is somewhat akin to the drink driving position. Drink driving (in almost all cases) carries a mandatory 12 months+ disqualification. But to prove it, the police need a breath or urine sample. So if the suspect fails to provide one, they can't be convicted. A loophole! Which is why failure to carry out a breath test or provide a sample (without good reason) is also an offence and carries the same penalty, ie 12 months' disqualification.

"All publically available encryption is monitored by governements after all they are years ahead in this field. Companies such as microsoft have to enable backdoors into their encryption to provide support for law enforcement."
WRONG. Microsofts own "Bitlocker" Has no built in backdoors, And they are not adding one for goverments help- Which is absolutly right, no goverment should have "special" access to backdoor encryption.

"The Police and CPS are both lazy in not using a brute force password charachter"
The reason they are not brute forcing as it would take the top supercomputer and 4 years to crack the password.

How bad that he is not in Bangalore. he could hav escaped freely, without any scar from the police.But plz dont go in front of judiciary here. carry on Oliver Drage

I would just like to say this is an excellent article. This case really shows that justice is not a word to be associated with the legal system in the UK.

Somehow the Judge in this case, as in many cases in the UK, has deluded themselves into thinking that they have some sort or moral high ground to stand on.

The RIPA is an orwellian piece of legislation and this case is just one in many that demonstrates the overarching reach of state oppression in this county.

I am not at all surprised by the police response either. The police in the UK are basically a violent gang that twist and manipulate events to suit their own personal grudges and agendas. There are many cases where the police have been shown to lie and even destroy evidence to obtain a conviction.

It is sad that this young man has been sent to a YOI (Young Offenders Institute), which is actually in many ways worse than prison, for forgetting his password.

What has happened here could be called many things but Justice is certainly not one of them.

My thoughts are with this young man and his family.