4 ms·

Wouldn't they have to prove that there was evidence pertaining specifically to the current case to get you for destroying evidence?

openasocket 11y ago
They could almost certainly get you for interfering with an investigation, though.
knodi123 11y ago
It must be the case that evidence can be either damning or exculpatory, and either way you're not allowed to destroy it. Otherwise destroying evidence would be incentivized, because once they can actually prove that the damning evidence was present before you destroyed it.... that proof is as good as having the evidence in the first place. A judge isn't a robot. If you say "I hit an emergency button to reformat my hard drives as the cops were breaking down the door, because I was preparing to sell those drives on ebay and needed to clean them up", the judge is not obligated to respond "Shoot, I can't prove otherwise, you're free to go."
- wang_li 11y ago
  "What the hell did you people do to my computer? Where's all my shit? I'm going to sue you assholes!!!"
  - knodi123 11y ago
    That's probably a decently clever approach. Thank goodness most criminals aren't clever. Or at least, so we assume based on the percentage of them who get caught.... Oh dear.
enraged_camel 11y ago
Exactly. Unless the device has untamperable auditing running behind the scenes that shows stuff was deleted, there's virtually no way for the police to know.
- wpietri 11y ago
  Probably not. Erasing leaves marks. The only marketable purpose for an instant erasure system like that is protection of information (personal or commercial). To build that, you'd make something that zeros all the files and deletes them, deletes and overwrites all the contacts, and such. But the structures left after that don't look like a brand new device. They look like you had a bunch of things and then erased them. Cops won't know what you erased, but they'll know you handed them a phone that was recently erased. Now maybe somebody will build an app tuned for obstruction of justice, so it tries to make the phone look brand new. And maybe you'll be very lucky and they'll get it working perfectly on your specific phone. But then you have to explain how you have a brand new phone that was actually purchased a year ago. And how it has no record of any of the calls that your phone carrier will have records of. The obvious conclusion is that you wiped it sometime after your last call and with special software that only appeals to people planning on hindering an investigation. Is that enough to convict you for obstruction of justice? I have no idea; it probably depends on how much a prosecutor cares. But is it enough to convince cops you are vigorously hiding something? You bet.
  - realusername 11y ago
    It depends, is there any legal requirement that the device actually has to record a call log normally ?
    - wpietri 11y ago
      Not sure how that matters. Is there any legal requirement to keep your receipts? No, but if you suddenly throw them out because you think the police might find them useful, that's still obstruction of justice.
  - PhantomGremlin 11y ago
    make something that zeros all the files and deletes them, deletes and overwrites all the contacts No, there's no need for anything that complicated. In principle, encrypting all data on a phone is really simple to implement. In practice, it's carefully thought out to avoid edge cases. The general idea is something like this: when first activated, the phone generates a random 256-bit AES key phone uses this random AES key to encrypt all data stored on the phone phone retains this random key in a special location, and encrypts this key by using the user-provided PIN To quickly erase all data on the phone, all that's necessary is to overwrite the key in the special location with random data. From that point on, there is no feasible way to recover anything on the phone. Period. It isn't necessary to erase an entire device. It's merely necessary to replace a 32-byte field (that contains the true AES key) with 32-bytes of random data. From then on, it doesn't matter what the PIN is. Data on the phone is jibberish unless and until the proper 256-bit AES key is produced. That key no long exists, so from that point on the only way to recover the data is by brute forcing AES, by trying all possible 2^256 combinations. They look like you had a bunch of things and then erased them No, what remains is indistinguishable from the case where the correct PIN hasn't been provided. Having "things" on the phone is no evidence of guilt. There is absolutely no evidence that the phone was erased. All that is known is that the provided PIN isn't able to decrypt the data.
tedunangst 11y ago
That's not hard. At the time of arrest, suspect was observed using Facebook. Here are the correlating logs from Facebook. After unlocking suspect's device using provided code, no Facebook login credentials were present, thus proving that the suspect used the erase code and not the usual code.
- Lawtonfogle 11y ago
  My defendant favors using private browsing mode for a number of reasons including preventing friends from being able to access his personal accounts and to lower the risk of tracking and accidentally acquiring viruses.
  - tedunangst 11y ago
    Here are the Facebook logs from the past two weeks all using the same session token, demonstrating that your client is lying. And now when you try to explain that ok, maybe some information was deleted but that's only because it was embarrassing, and it wasn't evidence of any crime whatsoever, you'll have zero credibility...
zmb_ 11y ago
Not for "anticipatory obstruction of justice". It doesn't matter whether what you destroyed is important to a case or not. There does not even need to be a case at all. You can still be charged if you deleted something, and maximum penalty is imprisonment for 20 years. Hanni Fakhoury, EFF attorney, gave a talk about this at ShmooCon 2012[1]. [1] https://www.youtube.com/watch?v=LzssKvRwrzQ https://www.youtube.com/watch?v=LzssKvRwrzQ
- Lawtonfogle 11y ago
  Doesn't this mean that even clearing your browsing cache is a crime? I deleted temp files recently because they were taking up a bunch of space. I did it to free up space but there could've been evidence there for some investigation (maybe some virus on my machine left evidence of who wrote the virus in temp files that would've allowed the feds to track down the creator). This seems like one of those laws that sounds good at first but makes a lot of normal behavior illegal, thus allowing the legal system to be able to pick and choose who gets punished.
  - secabeen 11y ago
    The burden is on the prosecution to prove that "The accused acted at least “in relation to” or “in contemplation’” of such issue or matter." https://en.wikipedia.org/wiki/Obstruction_of_justice#Obstruction_trends https://en.wikipedia.org/wiki/Obstruction_of_justice#Obstruc...

openasocket 11y ago

They could almost certainly get you for interfering with an investigation, though.

knodi123 11y ago

It must be the case that evidence can be either damning or exculpatory, and either way you're not allowed to destroy it. Otherwise destroying evidence would be incentivized, because once they can actually prove that the damning evidence was present before you destroyed it.... that proof is as good as having the evidence in the first place. A judge isn't a robot. If you say "I hit an emergency button to reformat my hard drives as the cops were breaking down the door, because I was preparing to sell those drives on ebay and needed to clean them up", the judge is not obligated to respond "Shoot, I can't prove otherwise, you're free to go."

wang_li 11y ago
"What the hell did you people do to my computer? Where's all my shit? I'm going to sue you assholes!!!"
- knodi123 11y ago
  That's probably a decently clever approach. Thank goodness most criminals aren't clever. Or at least, so we assume based on the percentage of them who get caught.... Oh dear.

enraged_camel 11y ago

Exactly. Unless the device has untamperable auditing running behind the scenes that shows stuff was deleted, there's virtually no way for the police to know.

wpietri 11y ago
Probably not. Erasing leaves marks. The only marketable purpose for an instant erasure system like that is protection of information (personal or commercial). To build that, you'd make something that zeros all the files and deletes them, deletes and overwrites all the contacts, and such. But the structures left after that don't look like a brand new device. They look like you had a bunch of things and then erased them. Cops won't know what you erased, but they'll know you handed them a phone that was recently erased. Now maybe somebody will build an app tuned for obstruction of justice, so it tries to make the phone look brand new. And maybe you'll be very lucky and they'll get it working perfectly on your specific phone. But then you have to explain how you have a brand new phone that was actually purchased a year ago. And how it has no record of any of the calls that your phone carrier will have records of. The obvious conclusion is that you wiped it sometime after your last call and with special software that only appeals to people planning on hindering an investigation. Is that enough to convict you for obstruction of justice? I have no idea; it probably depends on how much a prosecutor cares. But is it enough to convince cops you are vigorously hiding something? You bet.
- realusername 11y ago
  It depends, is there any legal requirement that the device actually has to record a call log normally ?
  - wpietri 11y ago
    Not sure how that matters. Is there any legal requirement to keep your receipts? No, but if you suddenly throw them out because you think the police might find them useful, that's still obstruction of justice.
- PhantomGremlin 11y ago
  make something that zeros all the files and deletes them, deletes and overwrites all the contacts No, there's no need for anything that complicated. In principle, encrypting all data on a phone is really simple to implement. In practice, it's carefully thought out to avoid edge cases. The general idea is something like this: when first activated, the phone generates a random 256-bit AES key phone uses this random AES key to encrypt all data stored on the phone phone retains this random key in a special location, and encrypts this key by using the user-provided PIN To quickly erase all data on the phone, all that's necessary is to overwrite the key in the special location with random data. From that point on, there is no feasible way to recover anything on the phone. Period. It isn't necessary to erase an entire device. It's merely necessary to replace a 32-byte field (that contains the true AES key) with 32-bytes of random data. From then on, it doesn't matter what the PIN is. Data on the phone is jibberish unless and until the proper 256-bit AES key is produced. That key no long exists, so from that point on the only way to recover the data is by brute forcing AES, by trying all possible 2^256 combinations. They look like you had a bunch of things and then erased them No, what remains is indistinguishable from the case where the correct PIN hasn't been provided. Having "things" on the phone is no evidence of guilt. There is absolutely no evidence that the phone was erased. All that is known is that the provided PIN isn't able to decrypt the data.

tedunangst 11y ago

That's not hard. At the time of arrest, suspect was observed using Facebook. Here are the correlating logs from Facebook. After unlocking suspect's device using provided code, no Facebook login credentials were present, thus proving that the suspect used the erase code and not the usual code.

Lawtonfogle 11y ago
My defendant favors using private browsing mode for a number of reasons including preventing friends from being able to access his personal accounts and to lower the risk of tracking and accidentally acquiring viruses.
- tedunangst 11y ago
  Here are the Facebook logs from the past two weeks all using the same session token, demonstrating that your client is lying. And now when you try to explain that ok, maybe some information was deleted but that's only because it was embarrassing, and it wasn't evidence of any crime whatsoever, you'll have zero credibility...

zmb_ 11y ago

Not for "anticipatory obstruction of justice". It doesn't matter whether what you destroyed is important to a case or not. There does not even need to be a case at all. You can still be charged if you deleted something, and maximum penalty is imprisonment for 20 years. Hanni Fakhoury, EFF attorney, gave a talk about this at ShmooCon 2012[1]. [1] https://www.youtube.com/watch?v=LzssKvRwrzQ https://www.youtube.com/watch?v=LzssKvRwrzQ

Lawtonfogle 11y ago
Doesn't this mean that even clearing your browsing cache is a crime? I deleted temp files recently because they were taking up a bunch of space. I did it to free up space but there could've been evidence there for some investigation (maybe some virus on my machine left evidence of who wrote the virus in temp files that would've allowed the feds to track down the creator). This seems like one of those laws that sounds good at first but makes a lot of normal behavior illegal, thus allowing the legal system to be able to pick and choose who gets punished.
- secabeen 11y ago
  The burden is on the prosecution to prove that "The accused acted at least “in relation to” or “in contemplation’” of such issue or matter." https://en.wikipedia.org/wiki/Obstruction_of_justice#Obstruction_trends https://en.wikipedia.org/wiki/Obstruction_of_justice#Obstruc...