10 ms·

The best part of this whole story is the unintended consequence of attack. Don't like someone, encrypt a zip drive with drivel, toss it in his car and call the

The best part of this whole story is the unintended consequence of attack. Don't like someone, encrypt a zip drive with drivel, toss it in his car and call the cops. Say you saw him looking at what could be kiddie porn. The guy doesn't know the password. Life in prison. No excuse. This applies not merely to Bob in Accounting that's a dick, but to everyone: Congress! Start sniping political enemies. A jump drive here. A hard drive there. Soon, you could have 6 or so Congressional individuals going to jail for a child porn ring. The Feds would think it's a great prisoner dilemma. No one's turning on each other. Again, anonymous tip claiming that the right honorable Representative Duggans was watching kiddie porn late at night in his office. The same tipster told the police that while he was jacking it he thanked Representative O'Connel for the present over the phone (make sure to wait for an actual call so their is evidence). Sure eventually all of this will die down. Until then, for $100 bucks and a few hours you can sit back, eat some popcorn and watch the system implode. Do it right and you'll get years of fun for everyone.

Kristine1975 10y ago
A zip drive with no fingerprints of the person it supposedly belongs to? Not very convincing. Also in this case the prosecution apparently has a bit more information that just "he did it": A subsequent forensic exam of his Mac Pro computer revealed that Doe had installed a virtual machine ... the examiner found one image of what appeared to be a 14-year-old child wearing a bathing suit and posed in a sexually suggestive position. There were also log files that indicated that Doe had visited groups titled: “toddler_cp,” “lolicam,” “hussy,” “child models – girls,” “pedomom,” “tor- childporn,” and “pthc,” terms that are commonly used in child exploitation. ... The exam showed that Doe accessed or attempted to access more than 20,000 files with file names consistent with obvious child pornography... and that he used the external hard drives seized by Delaware County detectives to access and store the images.
- sspiff 10y ago
  Wouldn't stop the police from keeping him behind bars. "He went through the trouble of encrypting the drive and keeping it clean from prints, but we found it in his car. He's clearly a well organized, determined child porn consumer." Perhaps you have too much faith in law enforcement, or I have grown too cynical by what I perceive as the dawn of a new era of police states.
  - Programmatic 10y ago
    I am no fan of compelled decryption, and believe it is a violation of 5th amendment rights. That being said, I think the government's argument is stronger than usual having proven that he has accessed files regularly in the encrypted drive by showing logs of regular access to content with suspicious filenames. The police have a fundamentally different argument here than "it happened to be in his possession".
    - sspiff 10y ago
      I agree, and looking at the story that is available to us here, the guy in question is very suspect. However, that does not mean we can or should change the rules (or define new rules) to put him in jail. I'd prefer they use another way to convict this guy. I'm also careful not to condemn a suspect based on what the media reports about him and his case (the court of public opinion is a dangerous thing). The fifth amendment is one of the few defenses you can call on when facing the incredibly skewed US legal system, and should not be chipped away at, even in a case like this.
    - FLUX-YOU 10y ago
      >That being said, I think the government's argument is stronger than usual having proven that he has accessed files regularly in the encrypted drive by showing logs of regular access to content with suspicious filenames. I'm not sure why the case has to stop while the drive remains encrypted then. If they do get the drive decrypted and find nothing (perhaps he held no files and is protesting against forced decryption or they simply have the wrong drive) that will hurt the prosecution. To me, the judge has basically said you can be locked up indefinitely for accessing suspicious file names. I'm not going to lie though, 20,000 entries would make me pretty fucking suspicious. I think almost all of us would immediately report that to the cops if we saw that in our networks without verifying what's inside.
- virmundi 10y ago
  I agree that the case here is a bit more compelling. You're also correct in the lack of some evidence in the attach scheme. You can overcome the fingerprints by handing things out for free. Here's a jump drive from some corp. You can also it in a cup holder. The person would touch the jump drive while being a bit perplexed. If you know the person, you can probably get them to hold it for you by simply handing it to them. Yes, you have to be more involved, but at the same time it's doable.
CPLX 10y ago
Or you could just put actual kiddie porn on the planted hard drives and save yourself this entire legal conundrum.
- spacemanmatt 10y ago
  Then you have gotten your hands very much dirtier than necessary. A good attack should not put you at such risk.
- avar 10y ago
  Coming up with real fake evidence is a lot harder than just coming up with a random blob that the cops think is evidence the suspect is hiding. E.g. are you really able to carefully craft a filesystem image that you're sure has no metadata that proves the innocence of the suspect?
  - falcolas 10y ago
    Eh, not so hard. Proxy their internet for a browsing session, and you put thumbnails of images in their cache. If they have any encrypted drive, or any encrypted blobs (could push those into their cache as well), and they're not going to have a great day. Cached images has been enough to put away more than a few folks - there was also recently a story about using exactly that tactic against a suspected spy.
    - avar 10y ago
      This is really moving the goalpost from the grandparent's comment of "encrypt a zip drive with drivel, toss it in his car and call the cops". Yes of course you can get an active MiTM session going you can do a lot of shady stuff.
      - falcolas 10y ago
        It can easily be used in tandem with the encrypted drive, to create probable cause to suspect the drive. And MiTM is far too simple to do. One of my friends was able to rickroll many a person with about $100 of gear. It was always troubling to watch my computer connect to my home network while at a conference, with no real notification to me.
sametmax 10y ago
This would work for your average Joe, but not for Congressmen. Unless somebody more powerful than them want them gone, they will have the resources to just deflect the problem. Honestly, how many politicians have you seen going to jail ? Does it match the global % of population in jail ?
- shortly 10y ago
  it's almost as though congressmen undergo some kind of selection process which attempts to find responsible, non-criminal members of society
  - sametmax 10y ago
    That would be a good hypothesis if politicians wouldn't be constantly being caught lying, cheating and breaking promises, starting wars or saving bankrupt industries with people's money. But since they do that, with little consequences, the theory that they are actually good at getting what they want without paying the cost we would pay for something far smaller seems more likely.
    - brianbarker 10y ago
      Think you missed the sarcasm.
      - jerf 10y ago
        sametmax disagreed with the sarcasm. So do I. There is a selection process. It is not selecting for non-criminality. It isn't selecting for criminality necessarily either, but it certainly is not strongly selecting against, in the sense intended.
    - izzydata 10y ago
      Being a terrible person isn't against the law.
      - deleted 10y ago
tptacek 10y ago
That's not what happened here. Read the DOJ's filing. * The accused admitted to knowing the password and refused to provide it, on the auspices of not wanting investigators snooping through his files. Only later did they claim to have "forgotten" it. * Prosecutors entered into evidence multiple factual claims establishing that the accused knew the password; for instance: years of eyewitness testimony demonstrating the accused entering the password from memory. Whenever you get to an alarming conclusion like "this means forgetting the password to your laptop means life in prison", chances are, you've missed relevant details.
- cpncrunch 10y ago
  Also, he showed his own family child porn, and they have actually found searches for child porn in a VM on the computer. >Whenever you get to an alarming conclusion like "this means forgetting the password to your laptop means life in prison", chances are, you've missed relevant details. Unfortunately responses like the parent comment are predictable on HN. There is the constant narrative that the government is out to get us all. Yet the example given is someone who already has a lot of evidence of child porn, and a frickin police officer no less.
  - tremon 10y ago
    Then he should be sentenced on the other evidence anyway. The failure to provide additional incriminating evidence could be used as an aggravating circumstance in the ruling, not as a separate crime with infinite detainment. (edit: replaced punishment with detainment, it's probably more neutral)
    - tptacek 10y ago
      For the punishment to be infinite, wouldn't the courts at every level up to SCOTUS would have to agree to its reasonableness? (Subtextually, I'm saying: the punishment isn't infinite.)
    - marcoperaza 10y ago
      It's not a punishment. It's being held in contempt of court for refusing to obey a court order. He holds the keys to his own freedom; he has to provide the password.
elcct 10y ago
> Don't like someone, encrypt a zip drive with drivel, toss it in his car and call the cops. So data has become new drugs ;)

Kristine1975 10y ago

A zip drive with no fingerprints of the person it supposedly belongs to? Not very convincing. Also in this case the prosecution apparently has a bit more information that just "he did it": A subsequent forensic exam of his Mac Pro computer revealed that Doe had installed a virtual machine ... the examiner found one image of what appeared to be a 14-year-old child wearing a bathing suit and posed in a sexually suggestive position. There were also log files that indicated that Doe had visited groups titled: “toddler_cp,” “lolicam,” “hussy,” “child models – girls,” “pedomom,” “tor- childporn,” and “pthc,” terms that are commonly used in child exploitation. ... The exam showed that Doe accessed or attempted to access more than 20,000 files with file names consistent with obvious child pornography... and that he used the external hard drives seized by Delaware County detectives to access and store the images.

sspiff 10y ago
Wouldn't stop the police from keeping him behind bars. "He went through the trouble of encrypting the drive and keeping it clean from prints, but we found it in his car. He's clearly a well organized, determined child porn consumer." Perhaps you have too much faith in law enforcement, or I have grown too cynical by what I perceive as the dawn of a new era of police states.
- Programmatic 10y ago
  I am no fan of compelled decryption, and believe it is a violation of 5th amendment rights. That being said, I think the government's argument is stronger than usual having proven that he has accessed files regularly in the encrypted drive by showing logs of regular access to content with suspicious filenames. The police have a fundamentally different argument here than "it happened to be in his possession".
  - sspiff 10y ago
    I agree, and looking at the story that is available to us here, the guy in question is very suspect. However, that does not mean we can or should change the rules (or define new rules) to put him in jail. I'd prefer they use another way to convict this guy. I'm also careful not to condemn a suspect based on what the media reports about him and his case (the court of public opinion is a dangerous thing). The fifth amendment is one of the few defenses you can call on when facing the incredibly skewed US legal system, and should not be chipped away at, even in a case like this.
  - FLUX-YOU 10y ago
    >That being said, I think the government's argument is stronger than usual having proven that he has accessed files regularly in the encrypted drive by showing logs of regular access to content with suspicious filenames. I'm not sure why the case has to stop while the drive remains encrypted then. If they do get the drive decrypted and find nothing (perhaps he held no files and is protesting against forced decryption or they simply have the wrong drive) that will hurt the prosecution. To me, the judge has basically said you can be locked up indefinitely for accessing suspicious file names. I'm not going to lie though, 20,000 entries would make me pretty fucking suspicious. I think almost all of us would immediately report that to the cops if we saw that in our networks without verifying what's inside.
virmundi 10y ago
I agree that the case here is a bit more compelling. You're also correct in the lack of some evidence in the attach scheme. You can overcome the fingerprints by handing things out for free. Here's a jump drive from some corp. You can also it in a cup holder. The person would touch the jump drive while being a bit perplexed. If you know the person, you can probably get them to hold it for you by simply handing it to them. Yes, you have to be more involved, but at the same time it's doable.

CPLX 10y ago

Or you could just put actual kiddie porn on the planted hard drives and save yourself this entire legal conundrum.

spacemanmatt 10y ago
Then you have gotten your hands very much dirtier than necessary. A good attack should not put you at such risk.
avar 10y ago
Coming up with real fake evidence is a lot harder than just coming up with a random blob that the cops think is evidence the suspect is hiding. E.g. are you really able to carefully craft a filesystem image that you're sure has no metadata that proves the innocence of the suspect?
- falcolas 10y ago
  Eh, not so hard. Proxy their internet for a browsing session, and you put thumbnails of images in their cache. If they have any encrypted drive, or any encrypted blobs (could push those into their cache as well), and they're not going to have a great day. Cached images has been enough to put away more than a few folks - there was also recently a story about using exactly that tactic against a suspected spy.
  - avar 10y ago
    This is really moving the goalpost from the grandparent's comment of "encrypt a zip drive with drivel, toss it in his car and call the cops". Yes of course you can get an active MiTM session going you can do a lot of shady stuff.
    - falcolas 10y ago
      It can easily be used in tandem with the encrypted drive, to create probable cause to suspect the drive. And MiTM is far too simple to do. One of my friends was able to rickroll many a person with about $100 of gear. It was always troubling to watch my computer connect to my home network while at a conference, with no real notification to me.

sametmax 10y ago

This would work for your average Joe, but not for Congressmen. Unless somebody more powerful than them want them gone, they will have the resources to just deflect the problem. Honestly, how many politicians have you seen going to jail ? Does it match the global % of population in jail ?

shortly 10y ago
it's almost as though congressmen undergo some kind of selection process which attempts to find responsible, non-criminal members of society
- sametmax 10y ago
  That would be a good hypothesis if politicians wouldn't be constantly being caught lying, cheating and breaking promises, starting wars or saving bankrupt industries with people's money. But since they do that, with little consequences, the theory that they are actually good at getting what they want without paying the cost we would pay for something far smaller seems more likely.
  - brianbarker 10y ago
    Think you missed the sarcasm.
    - jerf 10y ago
      sametmax disagreed with the sarcasm. So do I. There is a selection process. It is not selecting for non-criminality. It isn't selecting for criminality necessarily either, but it certainly is not strongly selecting against, in the sense intended.
  - izzydata 10y ago
    Being a terrible person isn't against the law.
    - deleted 10y ago

tptacek 10y ago

That's not what happened here. Read the DOJ's filing. * The accused admitted to knowing the password and refused to provide it, on the auspices of not wanting investigators snooping through his files. Only later did they claim to have "forgotten" it. * Prosecutors entered into evidence multiple factual claims establishing that the accused knew the password; for instance: years of eyewitness testimony demonstrating the accused entering the password from memory. Whenever you get to an alarming conclusion like "this means forgetting the password to your laptop means life in prison", chances are, you've missed relevant details.

cpncrunch 10y ago
Also, he showed his own family child porn, and they have actually found searches for child porn in a VM on the computer. >Whenever you get to an alarming conclusion like "this means forgetting the password to your laptop means life in prison", chances are, you've missed relevant details. Unfortunately responses like the parent comment are predictable on HN. There is the constant narrative that the government is out to get us all. Yet the example given is someone who already has a lot of evidence of child porn, and a frickin police officer no less.
- tremon 10y ago
  Then he should be sentenced on the other evidence anyway. The failure to provide additional incriminating evidence could be used as an aggravating circumstance in the ruling, not as a separate crime with infinite detainment. (edit: replaced punishment with detainment, it's probably more neutral)
  - tptacek 10y ago
    For the punishment to be infinite, wouldn't the courts at every level up to SCOTUS would have to agree to its reasonableness? (Subtextually, I'm saying: the punishment isn't infinite.)
  - marcoperaza 10y ago
    It's not a punishment. It's being held in contempt of court for refusing to obey a court order. He holds the keys to his own freedom; he has to provide the password.

elcct 10y ago

> Don't like someone, encrypt a zip drive with drivel, toss it in his car and call the cops. So data has become new drugs ;)