4 ms·

Wiping phone data isn't a crime unless it's done during part of an investigation where that specific data was already targeted. This is like saying if I delete

by Evolved 11y ago

Wiping phone data isn't a crime unless it's done during part of an investigation where that specific data was already targeted. This is like saying if I delete a note from my notes app then I've destroyed evidence because at some unknown point in the future someone might subpoena that note for use against me in a crime I may never commit.

ak4g 11y ago
I was referring to the situation in the comment I was replying to, where a number of individuals have both valid and canary keys for unlocking an HSM, and the presence of a canary key when attempting to unlock causes the HSM to wipe it's protected key, but it can't be established which individual did not cooperate. So the starting premise is that the device in question is already under the control of LE, a group of individuals has the ability to unlock the device (if they provide the correct keys), and they are being legally compelled to do so. In that specific situation, if anyone "defects" (provides the canary key), it's a crime, and everyone can go down for conspiracy, even if they themselves provided a valid key (which, in this scenario, is something we're assuming couldn't be proven anyway) and even if they never intended to break the law. That's the key part of a conspiracy prosecution - it doesn't matter which participant actually committed the crime, all the participants can be tried as if they were the "trigger-man". TBH I'm not up for tracking all this down in the US legal code (got stuff to do, and IANAL), but here's the statute in the California penal code: http://codes.findlaw.com/ca/penal-code/pen-sect-182.html http://codes.findlaw.com/ca/penal-code/pen-sect-182.html Note, in particular (heavily snipped for brevity/relevance): > (a) If two or more persons conspire: [snip] (5) To commit any act injurious to the public health, to public morals, or to pervert or obstruct justice, or the due administration of the laws. > They are punishable as follows: [snippity snippity snip....] When they conspire to commit any other felony, they shall be punishable in the same manner and to the same extent as is provided for the punishment of that felony. There's no provision that the conspirators (or the prosecution) know which of their number actually committed the crime. None of this would be relevant for HSMs on devices that aren't part of an investigation, or in general, any situation except one where a group of people are being legally compelled to enable access to evidence. The bigger-picture point is just that using a split-key mechanism to give plausible deniability to each individual key-holder doesn't actually pose any problem for the criminal justice system. Legal authority would be pretty meaningless if it could be foiled by crypto gimmicks. IRL, it's "haha, very clever, now the HSM gets unlocked or all of you go down for obstruction." edit: fixing formatting of the quoted blocks
- Natanael_L 11y ago
  Exactly: > (a) If two or more persons conspire: [snip] (5) To commit any act injurious to the public health, to public morals, or to pervert or obstruct justice, or the due administration of the laws. This entire section would not apply, because that was never the intent of any participant during setup - it is a hacking protection fail-safe. They wanted to comply with the law, but after-the-fact some techs defected due to not trusting law enforcement.

by Evolved 11y ago

ak4g 11y ago

I was referring to the situation in the comment I was replying to, where a number of individuals have both valid and canary keys for unlocking an HSM, and the presence of a canary key when attempting to unlock causes the HSM to wipe it's protected key, but it can't be established which individual did not cooperate. So the starting premise is that the device in question is already under the control of LE, a group of individuals has the ability to unlock the device (if they provide the correct keys), and they are being legally compelled to do so. In that specific situation, if anyone "defects" (provides the canary key), it's a crime, and everyone can go down for conspiracy, even if they themselves provided a valid key (which, in this scenario, is something we're assuming couldn't be proven anyway) and even if they never intended to break the law. That's the key part of a conspiracy prosecution - it doesn't matter which participant actually committed the crime, all the participants can be tried as if they were the "trigger-man". TBH I'm not up for tracking all this down in the US legal code (got stuff to do, and IANAL), but here's the statute in the California penal code: http://codes.findlaw.com/ca/penal-code/pen-sect-182.html http://codes.findlaw.com/ca/penal-code/pen-sect-182.html Note, in particular (heavily snipped for brevity/relevance): > (a) If two or more persons conspire: [snip] (5) To commit any act injurious to the public health, to public morals, or to pervert or obstruct justice, or the due administration of the laws. > They are punishable as follows: [snippity snippity snip....] When they conspire to commit any other felony, they shall be punishable in the same manner and to the same extent as is provided for the punishment of that felony. There's no provision that the conspirators (or the prosecution) know which of their number actually committed the crime. None of this would be relevant for HSMs on devices that aren't part of an investigation, or in general, any situation except one where a group of people are being legally compelled to enable access to evidence. The bigger-picture point is just that using a split-key mechanism to give plausible deniability to each individual key-holder doesn't actually pose any problem for the criminal justice system. Legal authority would be pretty meaningless if it could be foiled by crypto gimmicks. IRL, it's "haha, very clever, now the HSM gets unlocked or all of you go down for obstruction." edit: fixing formatting of the quoted blocks

Natanael_L 11y ago
Exactly: > (a) If two or more persons conspire: [snip] (5) To commit any act injurious to the public health, to public morals, or to pervert or obstruct justice, or the due administration of the laws. This entire section would not apply, because that was never the intent of any participant during setup - it is a hacking protection fail-safe. They wanted to comply with the law, but after-the-fact some techs defected due to not trusting law enforcement.