8 ms·

How is that "ugly?" - Case by case basis (i.e. not a giant dragnet). - Proper court process (i.e. warrants). - Likely not done in complete secret and with no

How is that "ugly?" - Case by case basis (i.e. not a giant dragnet). - Proper court process (i.e. warrants). - Likely not done in complete secret and with normal regularity oversight. That's the gold standard to me, not the ugly. I WANT courts to issue warrants against individuals based on a real concrete criminal case.

tuna-piano 10y ago
Exactly. If you think the government should be able to gain access to your house, filing cabinet, etc- with a warrant, why not your phone as well? The issue with the Snowden revelations and similiar programs is that there is no warrant or court process.
- tanderson92 10y ago
  The only way to enforce a requirement that the government should be able to access your device / encrypted message / computer, is to require that software be written to follow government-mandated protocols which will allow the access and decryption. IMO, that's clearly a 1st amendment violation.
  - amckinlay 10y ago
    You mean like https://en.wikipedia.org/wiki/Communications_Assistance_for_Law_Enforcement_Act https://en.wikipedia.org/wiki/Communications_Assistance_for_... ?
  - angli 10y ago
    It's possible that you'll design a safe that the government cannot get into without destroying the contents. We say that the government can do their best to get into that safe if they have a warrant. There is no requirement that they be able to access the content (building the safe is not illegal), but there is a procedure that lets them try under appropriate conditions. What the parent posters have been talking about is a permission structure like that where law enforcement can try their best. Doesn't force anyone to write software in a particular way.
    - tanderson92 10y ago
      How do you enforce this: > On a case-by-case basis, with proper court process, requiring an individual to provide a passcode or thumbprint to unlock a device could assist law enforcement in obtaining critical evidence without undermining the security or privacy of the broader population. I can write a piece of messaging software which writes one of the following two in a log, without exception: (1) hash of /dev/urandom (2) message history with passphrase encryption If the government comes to me and asks for my passphrase and I say "I don't have one", how can they prove that I have a passphrase and am in contempt of any lawful order? The only actual way to enforce this is to make it illegal to write software which does (1). My point is: the reason the quoted parts in the top-level post are ugly is because search warrants should already be sufficient, unless you want to crack down on the ability of citizens to do the above.
      - cryptarch 10y ago
        What I'm more frightful of, is not knowingly possessing this data but having it planted on me, e.g. a plaintext crypto header with random data, stenographically encoded into a video I'm streaming, stored in my browser cache, and this being discovered when the TSA-equivalent of a country I'm visiting surreptiously scans my HDD (because unless they hide it from me I'd much rather refuse, sit in a booth with angry men for 24 hours and get sent back to my home country). If not decrypting what looks like random bytes (because that's what good encryption looks like) becomes punishable in a country, it's no longer safe to visit that country with any digital data carriers.
- sbuttgereit 10y ago
  None of those Fourth Amendment concerns are at play. What is at stake are the limits of the Fifth Amendment. I think there's more here than just that, but that's the more interesting part.... and may well be "ugly". If you can be forced to divulge something that you know in order to convict yourself, where exactly do you draw the line? Yes, revealing a password that you know isn't exactly forced confession, but there are a lot of stops along that path that are short of being forced to confess and yet probably prejudicial against yourself. So what is the right being defended and are the current boundaries appropriate?
  - AnthonyMouse 10y ago
    > revealing a password that you know isn't exactly forced confession Revealing a password reveals that you knew the password. It's admitting to having access to the device. There is also the obvious problem when you don't know the password. It's manifestly unreasonable to punish someone for not doing something they can't actually do. But if not knowing is unconditionally a valid excuse then this is all a just hair splitting exercise to determine how defendants will phrase the refusal. And if it's only conditionally a valid excuse then you're back to forcing someone to testify as to why they don't know the password (e.g. admitting "that's not my phone").
    - danenania 10y ago
      People forget their passwords all the time, even after using them regularly for long periods of time. Unless we want to risk keeping people in prison their whole lives in order to compel information they simply don't have, wouldn't a simple 'I forgot' have to suffice, even if it's for a device proven to belong to the suspect?
- wyager 10y ago
  There's a difference between a filing cabinet and your brain. > why not your phone as well They can do whatever they want to my phone with a warrant. What they can't do is force me against my will to testify as to the contents of the phone. Be very careful not to conflate those two activities.
- JoshTriplett 10y ago
  > If you think the government should be able to gain access to your house, filing cabinet, etc- with a warrant, why not your phone as well? They can gain physical access to the phone, just like they can gain physical access to a safe; they can also compel the production of physical keys or security tokens, if any. They can't compel you to provide information from your mind, such as the passphrase to a phone.
  - nightcracker 10y ago
    "Tell us where the body is buried, or we'll hold you in contempt of court." Being compelled to produce any information from your mind to incriminate yourself is not acceptable.
    - JoshTriplett 10y ago
      I think we're in complete agreement here.
    - deleted 10y ago
      [deleted]
  - ori_b 10y ago
    Why is information from your mind, like your phone passphrase, significantly different from other information to your mind, like the location of a physical key?
    - Fnoord 10y ago
      > Why is information from your mind, like your phone passphrase, significantly different from other information to your mind, like the location of a physical key? In the USA because of the Fifth Amendment which protects individuals from being forced to incriminate themselves. [1] Other (civilised) countries have similar laws. Which makes something like the UK law which forces an individual to reveal their private key, at conflict. Specifically about my own country, The Netherlands recently adopted a revision of the computer criminality law (it being v3 of it). It is called the 'hack back law' because one major part of it is it allows the police to hack suspects. That's not all it is about though. Of note, the part scrapped was the one about a suspect being forced to hand over their private key. [1] https://en.wikipedia.org/wiki/Fifth_Amendment_to_the_United_States_Constitution#Self-incrimination https://en.wikipedia.org/wiki/Fifth_Amendment_to_the_United_...
- cesarb 10y ago
  An encrypted device is more similar to a diary written in code. Can they compel you to tell them how to decode your diary, or force you to produce a decoded copy of your diary?
- white-flame 10y ago
  They can access your filing cabinet, but if they don't understand what's written on the papers inside, can they compel you to decode the full meaning of all papers so that they can evaluate it? They can have access to physical stuff, but not to information that they are not privy to.
  - cryptarch 10y ago
    How about puzzles for a metaphor? The police can seize my puzzles, but they can't compell me to tell them the solution, even if they can't solve it themselves. It does miss the effects (potentially incriminating content being decrypted), and maybe it's a bit too silly.
- Fnoord 10y ago
  > The issue with the Snowden revelations and similiar programs is that there is no warrant or court process. For Americans, yes, or rather that the NSA meddles with internal US affairs at all. For the rest of the world, the issue is of privacy, economic espionage, and having no way to vote in the US to get rid of this practice. Apart from Merkel. She only cared her personal phone was tapped. Which is exactly what I expect the NSA to do: target specific high priority targets. Including heads of nation states. But, economic espionage and mass surveillance? No.
wyager 10y ago
Because they're claiming that they have the right to extract information that (allegedly, not even certainly) exists inside the defendant's head, i.e. to force a testimony. There's a very obvious difference between saying "We're allowed to look inside your documents and records" and "We're allowed to force you to give up any fact we claim you know on pain of contempt charges". Even worse is the fact that people might not actually remember encryption keys (it's happened to me several times), which would mean you could be kept in jail indefinitely for forgetting the password to some trivial volume. I know I've used Truecrypt to keep copies of business receipts and subsequently forgotten the password years later; imagine if the government had erroneously accused me of having illegal materials in that encrypted volume.
- Eridrus 10y ago
  Many countries already have these laws on the books, so you can see how it plays out in the rest of the world. In the case of your phone it's pretty unlikely you will not know the code.
nabla9 10y ago
Describe metadata analysis without giant dragnet. The beef in the metadata analysis comes with mass surveillance. Getting warrant to see where suspect sends emails is not in question. There is little analysis needed there.
- reitanqild 10y ago
  Very much can be done on a case-by-case basis: Get proper warrant, ask telecom provider to provide call logs for customer under investigation. Analyse. Ask for call records for other customers that seems to be interesting based on initial study (if necessary after getting extended warrant.) None of this needs a constant omnipresent dragnet ir secret courts interpreting secret laws in secret ways. I'd go so far as to say it is dangerous to spread the idea that this is necessary.
  - idlewords 10y ago
    Your comment implies a vast private-sector dragnet, obtainable by subpoena.
    - cryptarch 10y ago
      You mean Google/Gmail and Facebook? That ought to do for at least 90% of all cases.
    - reitanqild 10y ago
      No it means detailed phone bills.
gred 10y ago
I see where you're coming from, but a few observations: - The judicial branch is wading through this question now (sometimes allowing compulsion, often not); it's not a question for Congress to answer, as appealing as it might be to them to help us redefine our Constitutional rights. - We're in the analogy danger zone, but would you say that your phone is more like a safe or more like an extension of your mind? What do you think your answer will be 10 years from now? 20 years from now? - Dragnet vs. compelled disclosure is a false dichotomy. The NSA and friends will continue their collection of data + metadata at scale, regardless of the outcome here.
- peterwwillis 10y ago
  > The judicial branch is wading through this question now (sometimes allowing compulsion, often not); it's not a question for Congress to answer, as appealing as it might be to them to help us redefine our Constitutional rights. IANAL, but from what I recall, the entire point of the legislative branch is to create, remove, and re-define constitutional rights. The judicial affirms what they are, and the executive violates them. (Sorry, is that too on-the-nose?)
  - dgoldstein0 10y ago
    This is pretty close, but I would phrase it as the legislative branch gets to write the "fine print" of constitutional rights. Often the constitution is vague enough that the legislature has a large amount of creative license; sometimes though particular rights are given by the constitution or an amendment, in which case changing it in a large way, or removing it, requires another amendment - or else such attempted changes may be struck down by judicial challenge.
    - ethbro 10y ago
      The full US process could be summed as: The Constitution defines some rights and laws. Congress is empowered to grant additional rights and make additional laws. Congress also implements and defines rights and laws contained in the Constitution. If a citizen feels the Constitution has been violated by Congress, then the judicial system (headed by the Supreme Court) decides whether to invalidate the law(s) or not. If a majority of citizens wish to change the Constitution, then there is an amendment process.
ekianjo 10y ago
just to remind you SWAT was supposed to be case by case. Now they send it by default to destroy your door.
- GordonS 10y ago
  I think you have a point here - all too often there is a creeping escalation of the use of such powers.
FellowTraveler 10y ago
Perhaps you are unfamiliar with the 5th Amendment to the U.S. Constitution.
ekianjo 10y ago
> That's the gold standard to me, not the ugly. I WANT courts to issue warrants against individuals based on a real concrete criminal case. Then you are not aware of the state of things. Most courts now issue warrants without fact checking, simply based on police reporting info from dubious informers. That's not how it's supposed to work yet they are doing little more than just stamping requests for warrants now.

tuna-piano 10y ago

Exactly. If you think the government should be able to gain access to your house, filing cabinet, etc- with a warrant, why not your phone as well? The issue with the Snowden revelations and similiar programs is that there is no warrant or court process.

tanderson92 10y ago
The only way to enforce a requirement that the government should be able to access your device / encrypted message / computer, is to require that software be written to follow government-mandated protocols which will allow the access and decryption. IMO, that's clearly a 1st amendment violation.
- amckinlay 10y ago
  You mean like https://en.wikipedia.org/wiki/Communications_Assistance_for_Law_Enforcement_Act https://en.wikipedia.org/wiki/Communications_Assistance_for_... ?
- angli 10y ago
  It's possible that you'll design a safe that the government cannot get into without destroying the contents. We say that the government can do their best to get into that safe if they have a warrant. There is no requirement that they be able to access the content (building the safe is not illegal), but there is a procedure that lets them try under appropriate conditions. What the parent posters have been talking about is a permission structure like that where law enforcement can try their best. Doesn't force anyone to write software in a particular way.
  - tanderson92 10y ago
    How do you enforce this: > On a case-by-case basis, with proper court process, requiring an individual to provide a passcode or thumbprint to unlock a device could assist law enforcement in obtaining critical evidence without undermining the security or privacy of the broader population. I can write a piece of messaging software which writes one of the following two in a log, without exception: (1) hash of /dev/urandom (2) message history with passphrase encryption If the government comes to me and asks for my passphrase and I say "I don't have one", how can they prove that I have a passphrase and am in contempt of any lawful order? The only actual way to enforce this is to make it illegal to write software which does (1). My point is: the reason the quoted parts in the top-level post are ugly is because search warrants should already be sufficient, unless you want to crack down on the ability of citizens to do the above.
    - cryptarch 10y ago
      What I'm more frightful of, is not knowingly possessing this data but having it planted on me, e.g. a plaintext crypto header with random data, stenographically encoded into a video I'm streaming, stored in my browser cache, and this being discovered when the TSA-equivalent of a country I'm visiting surreptiously scans my HDD (because unless they hide it from me I'd much rather refuse, sit in a booth with angry men for 24 hours and get sent back to my home country). If not decrypting what looks like random bytes (because that's what good encryption looks like) becomes punishable in a country, it's no longer safe to visit that country with any digital data carriers.
sbuttgereit 10y ago
None of those Fourth Amendment concerns are at play. What is at stake are the limits of the Fifth Amendment. I think there's more here than just that, but that's the more interesting part.... and may well be "ugly". If you can be forced to divulge something that you know in order to convict yourself, where exactly do you draw the line? Yes, revealing a password that you know isn't exactly forced confession, but there are a lot of stops along that path that are short of being forced to confess and yet probably prejudicial against yourself. So what is the right being defended and are the current boundaries appropriate?
- AnthonyMouse 10y ago
  > revealing a password that you know isn't exactly forced confession Revealing a password reveals that you knew the password. It's admitting to having access to the device. There is also the obvious problem when you don't know the password. It's manifestly unreasonable to punish someone for not doing something they can't actually do. But if not knowing is unconditionally a valid excuse then this is all a just hair splitting exercise to determine how defendants will phrase the refusal. And if it's only conditionally a valid excuse then you're back to forcing someone to testify as to why they don't know the password (e.g. admitting "that's not my phone").
  - danenania 10y ago
    People forget their passwords all the time, even after using them regularly for long periods of time. Unless we want to risk keeping people in prison their whole lives in order to compel information they simply don't have, wouldn't a simple 'I forgot' have to suffice, even if it's for a device proven to belong to the suspect?
wyager 10y ago
There's a difference between a filing cabinet and your brain. > why not your phone as well They can do whatever they want to my phone with a warrant. What they can't do is force me against my will to testify as to the contents of the phone. Be very careful not to conflate those two activities.
JoshTriplett 10y ago
> If you think the government should be able to gain access to your house, filing cabinet, etc- with a warrant, why not your phone as well? They can gain physical access to the phone, just like they can gain physical access to a safe; they can also compel the production of physical keys or security tokens, if any. They can't compel you to provide information from your mind, such as the passphrase to a phone.
- nightcracker 10y ago
  "Tell us where the body is buried, or we'll hold you in contempt of court." Being compelled to produce any information from your mind to incriminate yourself is not acceptable.
  - JoshTriplett 10y ago
    I think we're in complete agreement here.
  - deleted 10y ago
    [deleted]
- ori_b 10y ago
  Why is information from your mind, like your phone passphrase, significantly different from other information to your mind, like the location of a physical key?
  - Fnoord 10y ago
    > Why is information from your mind, like your phone passphrase, significantly different from other information to your mind, like the location of a physical key? In the USA because of the Fifth Amendment which protects individuals from being forced to incriminate themselves. [1] Other (civilised) countries have similar laws. Which makes something like the UK law which forces an individual to reveal their private key, at conflict. Specifically about my own country, The Netherlands recently adopted a revision of the computer criminality law (it being v3 of it). It is called the 'hack back law' because one major part of it is it allows the police to hack suspects. That's not all it is about though. Of note, the part scrapped was the one about a suspect being forced to hand over their private key. [1] https://en.wikipedia.org/wiki/Fifth_Amendment_to_the_United_States_Constitution#Self-incrimination https://en.wikipedia.org/wiki/Fifth_Amendment_to_the_United_...
cesarb 10y ago
An encrypted device is more similar to a diary written in code. Can they compel you to tell them how to decode your diary, or force you to produce a decoded copy of your diary?
white-flame 10y ago
They can access your filing cabinet, but if they don't understand what's written on the papers inside, can they compel you to decode the full meaning of all papers so that they can evaluate it? They can have access to physical stuff, but not to information that they are not privy to.
- cryptarch 10y ago
  How about puzzles for a metaphor? The police can seize my puzzles, but they can't compell me to tell them the solution, even if they can't solve it themselves. It does miss the effects (potentially incriminating content being decrypted), and maybe it's a bit too silly.
Fnoord 10y ago
> The issue with the Snowden revelations and similiar programs is that there is no warrant or court process. For Americans, yes, or rather that the NSA meddles with internal US affairs at all. For the rest of the world, the issue is of privacy, economic espionage, and having no way to vote in the US to get rid of this practice. Apart from Merkel. She only cared her personal phone was tapped. Which is exactly what I expect the NSA to do: target specific high priority targets. Including heads of nation states. But, economic espionage and mass surveillance? No.

wyager 10y ago

Because they're claiming that they have the right to extract information that (allegedly, not even certainly) exists inside the defendant's head, i.e. to force a testimony. There's a very obvious difference between saying "We're allowed to look inside your documents and records" and "We're allowed to force you to give up any fact we claim you know on pain of contempt charges". Even worse is the fact that people might not actually remember encryption keys (it's happened to me several times), which would mean you could be kept in jail indefinitely for forgetting the password to some trivial volume. I know I've used Truecrypt to keep copies of business receipts and subsequently forgotten the password years later; imagine if the government had erroneously accused me of having illegal materials in that encrypted volume.

Eridrus 10y ago
Many countries already have these laws on the books, so you can see how it plays out in the rest of the world. In the case of your phone it's pretty unlikely you will not know the code.

nabla9 10y ago

Describe metadata analysis without giant dragnet. The beef in the metadata analysis comes with mass surveillance. Getting warrant to see where suspect sends emails is not in question. There is little analysis needed there.

reitanqild 10y ago
Very much can be done on a case-by-case basis: Get proper warrant, ask telecom provider to provide call logs for customer under investigation. Analyse. Ask for call records for other customers that seems to be interesting based on initial study (if necessary after getting extended warrant.) None of this needs a constant omnipresent dragnet ir secret courts interpreting secret laws in secret ways. I'd go so far as to say it is dangerous to spread the idea that this is necessary.
- idlewords 10y ago
  Your comment implies a vast private-sector dragnet, obtainable by subpoena.
  - cryptarch 10y ago
    You mean Google/Gmail and Facebook? That ought to do for at least 90% of all cases.
  - reitanqild 10y ago
    No it means detailed phone bills.

gred 10y ago

I see where you're coming from, but a few observations: - The judicial branch is wading through this question now (sometimes allowing compulsion, often not); it's not a question for Congress to answer, as appealing as it might be to them to help us redefine our Constitutional rights. - We're in the analogy danger zone, but would you say that your phone is more like a safe or more like an extension of your mind? What do you think your answer will be 10 years from now? 20 years from now? - Dragnet vs. compelled disclosure is a false dichotomy. The NSA and friends will continue their collection of data + metadata at scale, regardless of the outcome here.

peterwwillis 10y ago
> The judicial branch is wading through this question now (sometimes allowing compulsion, often not); it's not a question for Congress to answer, as appealing as it might be to them to help us redefine our Constitutional rights. IANAL, but from what I recall, the entire point of the legislative branch is to create, remove, and re-define constitutional rights. The judicial affirms what they are, and the executive violates them. (Sorry, is that too on-the-nose?)
- dgoldstein0 10y ago
  This is pretty close, but I would phrase it as the legislative branch gets to write the "fine print" of constitutional rights. Often the constitution is vague enough that the legislature has a large amount of creative license; sometimes though particular rights are given by the constitution or an amendment, in which case changing it in a large way, or removing it, requires another amendment - or else such attempted changes may be struck down by judicial challenge.
  - ethbro 10y ago
    The full US process could be summed as: The Constitution defines some rights and laws. Congress is empowered to grant additional rights and make additional laws. Congress also implements and defines rights and laws contained in the Constitution. If a citizen feels the Constitution has been violated by Congress, then the judicial system (headed by the Supreme Court) decides whether to invalidate the law(s) or not. If a majority of citizens wish to change the Constitution, then there is an amendment process.

ekianjo 10y ago

just to remind you SWAT was supposed to be case by case. Now they send it by default to destroy your door.

GordonS 10y ago
I think you have a point here - all too often there is a creeping escalation of the use of such powers.

FellowTraveler 10y ago

Perhaps you are unfamiliar with the 5th Amendment to the U.S. Constitution.

ekianjo 10y ago

> That's the gold standard to me, not the ugly. I WANT courts to issue warrants against individuals based on a real concrete criminal case. Then you are not aware of the state of things. Most courts now issue warrants without fact checking, simply based on police reporting info from dubious informers. That's not how it's supposed to work yet they are doing little more than just stamping requests for warrants now.