6 ms·

One-way encryption to a private key which is kept overseas back home. None of the data can be decrypted on foreign ground no matter what the authorities demand.

by yason 10y ago

One-way encryption to a private key which is kept overseas back home. None of the data can be decrypted on foreign ground no matter what the authorities demand. Automatically upload data home over a secure link when there's a connection.

Cerium 10y ago
We should be able to implement that on the SD card level. We could also make it selective and hide encrypted photos from the camera so there is no evidence that the system is in place. For example: after attempting to delete an image the next image is stored unencrypted. That way you can take pictures of non sensitive targets and build a false trail alongside the shadow encrypted images. When a camera is inspected scrolling through the image viewer will look normal.
- bitJericho 10y ago
  Simpler, store two images, one encrypted, one not. You can only review and delete the unencrypted one. Your decrypter back at home could automatically remove the deleted images so you don't have to review as much if there were no problems.
  - scott_karana 10y ago
    Good idea for most cases! Concealing ALL photos will still need to be an option for some, though: plausible deniability of "did you take pictures of X" when questioned :)
- semi-extrinsic 10y ago
  I'm pretty sure this is trivially implementable in CHDK [1]. Already, with the hacker-enabled RAW mode (this is on Canon P&S cameras), it saves a RAW copy of the image to the SD that never shows up in the camera browser. If you delete the JPG using the camera, the RAW file is still there, but not visible to the camera. So what you'd want to add, for safety's sake, is to make the camera save this RAW in a custom format (and folder and naming structure) that is inconspicuous, but can be read by your custom RAW software. E.g. save the RAWs in some scientific data format and say you're a student and those files are from some old class assignment you had to transfer. I estimate it would take a dedicated hacker less than a month to put together on their spare time. Without transmission capability, you can never guard against deletion (they could just confiscate or destroy the SD). [1] http://chdk.wikia.com/wiki/CHDK http://chdk.wikia.com/wiki/CHDK
- Retr0spectrum 10y ago
  IIRC some "wifi" SD cards run some form of linux, so it might be possible to hack in some encryption.
jfindley 10y ago
I thought about that, but that would mean it's then probably not possible to review the images you've taken to ensure that you got the shot you wanted.... I guess you could keep a second copy in a buffer somewhere, but I think however you handle this you either sacrifice a lot of usability or add quite a large vulnerability... There may be a more elegant solution I haven't thought of, however.
- Johnny555 10y ago
  My camera has a RAM buffer that images are stored in before it's flushed to the flash card. That doesn't help with reviewing 2 hours of video footage, but it does let you review the photo you just took before it's wiped from RAM.
  - jfindley 10y ago
    All serious cameras do - but it's typically fairly small and most image review happens from the sd/cf card, not the buffer. I think if you have instant review on (I don't ever use this setting) then it MIGHT happen from buffer, but I'm not certain. Anyway - yes on the face of it this seems possible - but most pros I know will shoot a large chunk of images and review afterwards in a batch - they typically don't review often enough for this to really work, otherwise they'd risk missing shots while reviewing, which is why I thought that in practice it might be hard to implement this well enough without compromising security.
- flashman 10y ago
  > it's then probably not possible to review the images you've taken to ensure that you got the shot you wanted Well, photographers in the film era managed to get by.
eriknstr 10y ago
But why should they believe that you really don't have the access to the key? You might end up with torture :/ Also, they could hold you captive and demand that you have someone at home send the key in exchange for your freedom.
- brokenmachine 10y ago
  Please list your alternative solution for storing photos where capture/torture is not a possibility.
  - eriknstr 10y ago
    I'd have to say that selectively keeping inconspicuous photos and transferring the "incriminating" ones via the internet (as suggested by others) seems to be the best possible course of action. Aside from that it seems better to allow the authorities immediate access to all photos without encryption. You might lose the pictures but I think you'll have a better chance at avoiding personal harm.
    - pbhjpbhj 10y ago
      If you're caught though there's a good chance you were seen taking pictures and those pictures not being present is going to be quite obvious. Also, if camera makers add this feature than those confiscating camera equipment will know about it. I don't really see how you can technologically avoid personal harm if you're in a war zone [or similar] taking imagery that some people don't want publishing and you're captured in that process. Harming you is the standard way of stopping you continuing to defy such people. Not being able to destroy the images taken is good, but it's not going to save cameras and people from being smashed up IMO.
- wolfgke 10y ago
  > But why should they believe that you really don't have the access to the key? You might end up with torture :/ On http://security.stackexchange.com/a/83059/6870 http://security.stackexchange.com/a/83059/6870 you can find a basic idea how you can create keys that you cannot have access to. There is of course some work to be done to fit it to the "camera scenario".
pavel_lishin 10y ago
> None of the data can be decrypted on foreign ground no matter what the authorities demand. You may have trouble convincing the local authorities of this. In some circumstances, it may be better to be able to provide a decryption key so they can review your photos and leave your kneecaps alone.
- godelski 10y ago
  This would force the authorities to call back to the journalist's home base. Meaning that their employer will now know that the journalist is being detained and lawyers can be contacted. This is probably one of the safest ways to do it. And if that became standard the authorities would know that the journalist doesn't have the password. As for reviewing the photos you could do it once they are uploaded, or just be able to display the last photo taken. There are ways to make that convenient and secure.
  - deleted 10y ago
    [deleted]
  - pavel_lishin 10y ago
    "Of course, officer, I can show you the photos I took on this camera. No, I can't show you on the camera. You need to give me access to a computer and let me type stuff for awhile!"
    - godelski 10y ago
      More like "I don't have access to the pictures officer. You need to contact these people." Then they likely destroy the camera. That ensures that sources are more protected than an unencrypted storage. See cases presented in the article. Better to have the footage destroyed than releasing the identity of your sources. But nice non sequitur.
qqrs 10y ago
Public key encryption does feel like it could be a useful approach. Rather than putting the burden on camera manufacturers, it could be implemented on a portable hard drive with SD card reader. (Turns out these already exist, just not with encryption: https://www.wdc.com/products/portable-storage/my-passport-wireless.html https://www.wdc.com/products/portable-storage/my-passport-wi...) This would allow the photographer to review photos on the camera until satisfied, then simply plug the SD card into the portable hard drive. All files would be automatically encrypted and saved to the hard drive, and the SD card would be wiped. The files on the hard drive can't be decrypted without the private key, stored at home.

by yason 10y ago

Cerium 10y ago

We should be able to implement that on the SD card level. We could also make it selective and hide encrypted photos from the camera so there is no evidence that the system is in place. For example: after attempting to delete an image the next image is stored unencrypted. That way you can take pictures of non sensitive targets and build a false trail alongside the shadow encrypted images. When a camera is inspected scrolling through the image viewer will look normal.

bitJericho 10y ago
Simpler, store two images, one encrypted, one not. You can only review and delete the unencrypted one. Your decrypter back at home could automatically remove the deleted images so you don't have to review as much if there were no problems.
- scott_karana 10y ago
  Good idea for most cases! Concealing ALL photos will still need to be an option for some, though: plausible deniability of "did you take pictures of X" when questioned :)
semi-extrinsic 10y ago
I'm pretty sure this is trivially implementable in CHDK [1]. Already, with the hacker-enabled RAW mode (this is on Canon P&S cameras), it saves a RAW copy of the image to the SD that never shows up in the camera browser. If you delete the JPG using the camera, the RAW file is still there, but not visible to the camera. So what you'd want to add, for safety's sake, is to make the camera save this RAW in a custom format (and folder and naming structure) that is inconspicuous, but can be read by your custom RAW software. E.g. save the RAWs in some scientific data format and say you're a student and those files are from some old class assignment you had to transfer. I estimate it would take a dedicated hacker less than a month to put together on their spare time. Without transmission capability, you can never guard against deletion (they could just confiscate or destroy the SD). [1] http://chdk.wikia.com/wiki/CHDK http://chdk.wikia.com/wiki/CHDK
Retr0spectrum 10y ago
IIRC some "wifi" SD cards run some form of linux, so it might be possible to hack in some encryption.

jfindley 10y ago

I thought about that, but that would mean it's then probably not possible to review the images you've taken to ensure that you got the shot you wanted.... I guess you could keep a second copy in a buffer somewhere, but I think however you handle this you either sacrifice a lot of usability or add quite a large vulnerability... There may be a more elegant solution I haven't thought of, however.

Johnny555 10y ago
My camera has a RAM buffer that images are stored in before it's flushed to the flash card. That doesn't help with reviewing 2 hours of video footage, but it does let you review the photo you just took before it's wiped from RAM.
- jfindley 10y ago
  All serious cameras do - but it's typically fairly small and most image review happens from the sd/cf card, not the buffer. I think if you have instant review on (I don't ever use this setting) then it MIGHT happen from buffer, but I'm not certain. Anyway - yes on the face of it this seems possible - but most pros I know will shoot a large chunk of images and review afterwards in a batch - they typically don't review often enough for this to really work, otherwise they'd risk missing shots while reviewing, which is why I thought that in practice it might be hard to implement this well enough without compromising security.
flashman 10y ago
> it's then probably not possible to review the images you've taken to ensure that you got the shot you wanted Well, photographers in the film era managed to get by.

eriknstr 10y ago

But why should they believe that you really don't have the access to the key? You might end up with torture :/ Also, they could hold you captive and demand that you have someone at home send the key in exchange for your freedom.

brokenmachine 10y ago
Please list your alternative solution for storing photos where capture/torture is not a possibility.
- eriknstr 10y ago
  I'd have to say that selectively keeping inconspicuous photos and transferring the "incriminating" ones via the internet (as suggested by others) seems to be the best possible course of action. Aside from that it seems better to allow the authorities immediate access to all photos without encryption. You might lose the pictures but I think you'll have a better chance at avoiding personal harm.
  - pbhjpbhj 10y ago
    If you're caught though there's a good chance you were seen taking pictures and those pictures not being present is going to be quite obvious. Also, if camera makers add this feature than those confiscating camera equipment will know about it. I don't really see how you can technologically avoid personal harm if you're in a war zone [or similar] taking imagery that some people don't want publishing and you're captured in that process. Harming you is the standard way of stopping you continuing to defy such people. Not being able to destroy the images taken is good, but it's not going to save cameras and people from being smashed up IMO.
wolfgke 10y ago
> But why should they believe that you really don't have the access to the key? You might end up with torture :/ On http://security.stackexchange.com/a/83059/6870 http://security.stackexchange.com/a/83059/6870 you can find a basic idea how you can create keys that you cannot have access to. There is of course some work to be done to fit it to the "camera scenario".

pavel_lishin 10y ago

> None of the data can be decrypted on foreign ground no matter what the authorities demand. You may have trouble convincing the local authorities of this. In some circumstances, it may be better to be able to provide a decryption key so they can review your photos and leave your kneecaps alone.

godelski 10y ago
This would force the authorities to call back to the journalist's home base. Meaning that their employer will now know that the journalist is being detained and lawyers can be contacted. This is probably one of the safest ways to do it. And if that became standard the authorities would know that the journalist doesn't have the password. As for reviewing the photos you could do it once they are uploaded, or just be able to display the last photo taken. There are ways to make that convenient and secure.
- deleted 10y ago
  [deleted]
- pavel_lishin 10y ago
  "Of course, officer, I can show you the photos I took on this camera. No, I can't show you on the camera. You need to give me access to a computer and let me type stuff for awhile!"
  - godelski 10y ago
    More like "I don't have access to the pictures officer. You need to contact these people." Then they likely destroy the camera. That ensures that sources are more protected than an unencrypted storage. See cases presented in the article. Better to have the footage destroyed than releasing the identity of your sources. But nice non sequitur.

qqrs 10y ago

Public key encryption does feel like it could be a useful approach. Rather than putting the burden on camera manufacturers, it could be implemented on a portable hard drive with SD card reader. (Turns out these already exist, just not with encryption: https://www.wdc.com/products/portable-storage/my-passport-wireless.html https://www.wdc.com/products/portable-storage/my-passport-wi...) This would allow the photographer to review photos on the camera until satisfied, then simply plug the SD card into the portable hard drive. All files would be automatically encrypted and saved to the hard drive, and the SD card would be wiped. The files on the hard drive can't be decrypted without the private key, stored at home.