4 ms·

It would be interesting to see what would happen if all the capable technical staff at Apple refused to unlock the device. Would the court pick one at random t

It would be interesting to see what would happen if all the capable technical staff at Apple refused to unlock the device. Would the court pick one at random to compel?

Natanael_L 11y ago
They'd have the ability to pick all of them. Contempt of court to all unless one agrees. In which case you make the tool require anonymous treshold signatures in where at least m of n technicians must issue the order. So that if n-(m+1) or more technicians refuse to cooperate, the request fails and you don't know who is innocent and who made the choice to break it. Unless of course everybody are forced to hand over their keypairs and all - in which case you go yet another step further and give them canary keys which then cause a lock-down (the HSM could even wipe its secret keys completely in this case), and you still don't know who did it.
- ak4g 11y ago
  If the HSM gets wiped, via whatever mechanism, you prosecute (successfully) everyone involved for obstruction of justice. At that point they've all participated in a criminal conspiracy to destroy evidence. The m'th hand doesn't have to know that the n'th hand gave the canary key; that changes nothing. You pre-arranged to allow yourself or a collaborator to commit a crime, and (at least) one of them did - everyone's guilty of the conspiracy charge, go directly to jail, do not pass go. The law doesn't have to - and never does - respect clever CS constructions.
  - Evolved 11y ago
    Wiping phone data isn't a crime unless it's done during part of an investigation where that specific data was already targeted. This is like saying if I delete a note from my notes app then I've destroyed evidence because at some unknown point in the future someone might subpoena that note for use against me in a crime I may never commit.
    - ak4g 11y ago
      I was referring to the situation in the comment I was replying to, where a number of individuals have both valid and canary keys for unlocking an HSM, and the presence of a canary key when attempting to unlock causes the HSM to wipe it's protected key, but it can't be established which individual did not cooperate. So the starting premise is that the device in question is already under the control of LE, a group of individuals has the ability to unlock the device (if they provide the correct keys), and they are being legally compelled to do so. In that specific situation, if anyone "defects" (provides the canary key), it's a crime, and everyone can go down for conspiracy, even if they themselves provided a valid key (which, in this scenario, is something we're assuming couldn't be proven anyway) and even if they never intended to break the law. That's the key part of a conspiracy prosecution - it doesn't matter which participant actually committed the crime, all the participants can be tried as if they were the "trigger-man". TBH I'm not up for tracking all this down in the US legal code (got stuff to do, and IANAL), but here's the statute in the California penal code: http://codes.findlaw.com/ca/penal-code/pen-sect-182.html http://codes.findlaw.com/ca/penal-code/pen-sect-182.html Note, in particular (heavily snipped for brevity/relevance): > (a) If two or more persons conspire: [snip] (5) To commit any act injurious to the public health, to public morals, or to pervert or obstruct justice, or the due administration of the laws. > They are punishable as follows: [snippity snippity snip....] When they conspire to commit any other felony, they shall be punishable in the same manner and to the same extent as is provided for the punishment of that felony. There's no provision that the conspirators (or the prosecution) know which of their number actually committed the crime. None of this would be relevant for HSMs on devices that aren't part of an investigation, or in general, any situation except one where a group of people are being legally compelled to enable access to evidence. The bigger-picture point is just that using a split-key mechanism to give plausible deniability to each individual key-holder doesn't actually pose any problem for the criminal justice system. Legal authority would be pretty meaningless if it could be foiled by crypto gimmicks. IRL, it's "haha, very clever, now the HSM gets unlocked or all of you go down for obstruction." edit: fixing formatting of the quoted blocks
      - Natanael_L 11y ago
        Exactly: > (a) If two or more persons conspire: [snip] (5) To commit any act injurious to the public health, to public morals, or to pervert or obstruct justice, or the due administration of the laws. This entire section would not apply, because that was never the intent of any participant during setup - it is a hacking protection fail-safe. They wanted to comply with the law, but after-the-fact some techs defected due to not trusting law enforcement.
  - JupiterMoon 11y ago
    There is a physical analogy here so we don't have to discuss CS constructions. There are physical safes constructed in a way that prevents opening by any means short of a blow torch. Any paper contents will be destroyed when breaking the safe by this method. Who gets charged with destruction of evidence in this situation?
    - Evolved 11y ago
      Not only this but can you be charged with destruction of evidence if there's no feasible way to prove that what's in the safe can actually incriminate you in a crime? In other words, if you don't know what's in the safe and you don't know what you don't know then you can't know what you don't know which means you can't know it is even evidence as it may not even be related or within the scope of the investigation.
      - JupiterMoon 11y ago
        I think that this scenario means you are guilty under current law in the US and the UK (we may not like it!) because until it is evaluated the evidence is still evidence. I'm thinking more of the situation that you locked the safe and also lost the key prior to its contents being declared evidence and that you cannot physically now open it. I am not a lawyer. I am definitely not your lawyer!
  - Natanael_L 11y ago
    But I didn't do it to break the law, I did it to prevent foreign hacker attacks. I have no part whatsoever in any conspiracy, every action of mine was legally justified! There's very very clear and obvious legal uses of this functionality. You need to prove the opposite claim for every single participant separately to throw them in jail, because there's otherwise no way to show they had anything to do with anything illegal. Due process and all that.
- eevilspock 11y ago
  > They'd have the ability to pick all of them. Contempt of court to all unless one agrees. What? No. The judge would be ordering Apple. A whole separate case would need to be brought ordering specific people. Let's game it through: 1. Tim Cook, following judges order, orders the engineers with the knowledge to unlock the device. 2. The engineers refuse Cook's order. He reports this to the judge. 4. Judge has two options: Order Cook to threaten to fire said employees, or individually order employees to comply. Most likely the former is legally untenable. He thus is forced to do the latter. I don't believe a judge would or even could go that far, except perhaps in times of war.
  - Natanael_L 11y ago
    The idea here was that every single employee asked to do it refuses, in which case it simply doesn't get done. So then contempt of court becomes relevant for the entire group.

It would be interesting to see what would happen if all the capable technical staff at Apple refused to unlock the device. Would the court pick one at random to compel?

Natanael_L 11y ago

They'd have the ability to pick all of them. Contempt of court to all unless one agrees. In which case you make the tool require anonymous treshold signatures in where at least m of n technicians must issue the order. So that if n-(m+1) or more technicians refuse to cooperate, the request fails and you don't know who is innocent and who made the choice to break it. Unless of course everybody are forced to hand over their keypairs and all - in which case you go yet another step further and give them canary keys which then cause a lock-down (the HSM could even wipe its secret keys completely in this case), and you still don't know who did it.

ak4g 11y ago
If the HSM gets wiped, via whatever mechanism, you prosecute (successfully) everyone involved for obstruction of justice. At that point they've all participated in a criminal conspiracy to destroy evidence. The m'th hand doesn't have to know that the n'th hand gave the canary key; that changes nothing. You pre-arranged to allow yourself or a collaborator to commit a crime, and (at least) one of them did - everyone's guilty of the conspiracy charge, go directly to jail, do not pass go. The law doesn't have to - and never does - respect clever CS constructions.
- Evolved 11y ago
  Wiping phone data isn't a crime unless it's done during part of an investigation where that specific data was already targeted. This is like saying if I delete a note from my notes app then I've destroyed evidence because at some unknown point in the future someone might subpoena that note for use against me in a crime I may never commit.
  - ak4g 11y ago
    I was referring to the situation in the comment I was replying to, where a number of individuals have both valid and canary keys for unlocking an HSM, and the presence of a canary key when attempting to unlock causes the HSM to wipe it's protected key, but it can't be established which individual did not cooperate. So the starting premise is that the device in question is already under the control of LE, a group of individuals has the ability to unlock the device (if they provide the correct keys), and they are being legally compelled to do so. In that specific situation, if anyone "defects" (provides the canary key), it's a crime, and everyone can go down for conspiracy, even if they themselves provided a valid key (which, in this scenario, is something we're assuming couldn't be proven anyway) and even if they never intended to break the law. That's the key part of a conspiracy prosecution - it doesn't matter which participant actually committed the crime, all the participants can be tried as if they were the "trigger-man". TBH I'm not up for tracking all this down in the US legal code (got stuff to do, and IANAL), but here's the statute in the California penal code: http://codes.findlaw.com/ca/penal-code/pen-sect-182.html http://codes.findlaw.com/ca/penal-code/pen-sect-182.html Note, in particular (heavily snipped for brevity/relevance): > (a) If two or more persons conspire: [snip] (5) To commit any act injurious to the public health, to public morals, or to pervert or obstruct justice, or the due administration of the laws. > They are punishable as follows: [snippity snippity snip....] When they conspire to commit any other felony, they shall be punishable in the same manner and to the same extent as is provided for the punishment of that felony. There's no provision that the conspirators (or the prosecution) know which of their number actually committed the crime. None of this would be relevant for HSMs on devices that aren't part of an investigation, or in general, any situation except one where a group of people are being legally compelled to enable access to evidence. The bigger-picture point is just that using a split-key mechanism to give plausible deniability to each individual key-holder doesn't actually pose any problem for the criminal justice system. Legal authority would be pretty meaningless if it could be foiled by crypto gimmicks. IRL, it's "haha, very clever, now the HSM gets unlocked or all of you go down for obstruction." edit: fixing formatting of the quoted blocks
    - Natanael_L 11y ago
      Exactly: > (a) If two or more persons conspire: [snip] (5) To commit any act injurious to the public health, to public morals, or to pervert or obstruct justice, or the due administration of the laws. This entire section would not apply, because that was never the intent of any participant during setup - it is a hacking protection fail-safe. They wanted to comply with the law, but after-the-fact some techs defected due to not trusting law enforcement.
- JupiterMoon 11y ago
  There is a physical analogy here so we don't have to discuss CS constructions. There are physical safes constructed in a way that prevents opening by any means short of a blow torch. Any paper contents will be destroyed when breaking the safe by this method. Who gets charged with destruction of evidence in this situation?
  - Evolved 11y ago
    Not only this but can you be charged with destruction of evidence if there's no feasible way to prove that what's in the safe can actually incriminate you in a crime? In other words, if you don't know what's in the safe and you don't know what you don't know then you can't know what you don't know which means you can't know it is even evidence as it may not even be related or within the scope of the investigation.
    - JupiterMoon 11y ago
      I think that this scenario means you are guilty under current law in the US and the UK (we may not like it!) because until it is evaluated the evidence is still evidence. I'm thinking more of the situation that you locked the safe and also lost the key prior to its contents being declared evidence and that you cannot physically now open it. I am not a lawyer. I am definitely not your lawyer!
- Natanael_L 11y ago
  But I didn't do it to break the law, I did it to prevent foreign hacker attacks. I have no part whatsoever in any conspiracy, every action of mine was legally justified! There's very very clear and obvious legal uses of this functionality. You need to prove the opposite claim for every single participant separately to throw them in jail, because there's otherwise no way to show they had anything to do with anything illegal. Due process and all that.
eevilspock 11y ago
> They'd have the ability to pick all of them. Contempt of court to all unless one agrees. What? No. The judge would be ordering Apple. A whole separate case would need to be brought ordering specific people. Let's game it through: 1. Tim Cook, following judges order, orders the engineers with the knowledge to unlock the device. 2. The engineers refuse Cook's order. He reports this to the judge. 4. Judge has two options: Order Cook to threaten to fire said employees, or individually order employees to comply. Most likely the former is legally untenable. He thus is forced to do the latter. I don't believe a judge would or even could go that far, except perhaps in times of war.
- Natanael_L 11y ago
  The idea here was that every single employee asked to do it refuses, in which case it simply doesn't get done. So then contempt of court becomes relevant for the entire group.