A ruling in a court case in the UK concerning intercepts of encrypted EncroChat mobile phone messages has decided that data in the phone’s RAM was being stored: nonsense in an IT sense, but nonetheless allowing law enforcement to use the information.
The judgement was outlined in a Register story – “EncroChat hack case: RAM, bam… what? Data in transit is data at rest, rules UK Court of Appeal” – and we delved into the actual judgement to see what was going on.
The UK Court of Appeal ruled that RAM counted as data storage. How can this be the case?
Two meanings
There are two meanings of storage that appear relevant to this: IT and common parlance. In everyday speech storage means the retention of something for future use and memory the faculty by which the mind stores and remembers information. Storage and memory overlap. Both, we might say, are persistent.
But we might also say that, in humans, when the power is switched off at the end of our lives, then the contents of our memory disappear, being to this extent “volatile”. (But we are playing with words here.)
In IT memory contents are volatile, disappearing when power to the DRAM is switched off, and storage is persistent, with the contents unaffected by on-off power cycles.
Storage vs transmission
In the court case a distinction was drawn between storage of information and transmission of data in telephone devices. Different warrants have to be obtained by the police for intercepting and copying transmission data and for copying “stored” data.
Information recovered via a stored data warrant cannot be used in a case involving information transmission. Neither can recovered transmission data be used in a case involving stored data.
The information recovery from the EncroChat phones was achieved with a storage warrant and not a transmission warrant. Defence counsel made the case that the warrants were inappropriate as the recovered data was being transmitted, as it had been copied from the phones’ DRAM and not their storage, or ‘Realm’ as it was called.
This argument relied upon the transmission process including the preparation of the data being included in a message. Thus that data would be fetched from storage and copied into DRAM. There it would be used to construct a message and be formatted before being sent to the phone’s transmission hardware: radio chip and antenna.
The justices ruled that “what was intercepted, was not the same as what had been transmitted because what had been transmitted was encrypted. It cannot therefore have been ‘being transmitted’ when it was intercepted: it can only have been ‘being stored’.” The ruling likened the extracted data to a “draft”.
No ‘technical terms’ in the 2016 Act
The Appeal Court justices disagreed with “expert witnesses” who explained that making a copy was part and parcel of the act of transmission, stating that while this might be true from an expert’s point of view, it was not the intent of the government when drafting the relevant Act of Parliament.
The judgement stated: “The experts have an important role in explaining how a system works, but no role whatever in construing an Act of Parliament. They appear to have assumed that because a communication appears in the RAM as an essential part of the process which results in the transmission it did so while ‘being transmitted’.
“That is an obvious error of language and analysis. It can be illustrated by considering the posting of a letter. The process involves the letter being written, put in an envelope, a stamp being attached and then the letter being placed in the post box. Only the last act involves the letter being transmitted by a system, but all the acts are essential to that transmission.”
As the relevant Act defined only two states for data: being stored or being transmitted, then, if it was not being transmitted it was being stored.
The reasoning was as follows: Data in RAM is not being transmitted. It is necessary for it to be in DRAM for a message to be prepared for transmission, but the act of preparation is not transmission. Therefore the data must be in a stored state and the warrant used to recover it was valid.
In other words, the common parlance meaning of storage takes precedence over the technical definition, despite the very technical issues at play.
