5 ms·

>If police have a proper search warrant then locking the computer will not matter, because the police will have a warrant to compel the company to turn over the

by Bud 9y ago

>If police have a proper search warrant then locking the computer will not matter, because the police will have a warrant to compel the company to turn over the specific evidence in question. Wrong. Compelling them to do so does not mean that compulsion will be successful. Encryption exists.

Consultant32452 9y ago
In the US at least you can be held in contempt and jailed indefinitely for not providing the decryption keys. Presumably other countries have mechanisms to deal with this beyond, "Oh gee, you password protected it, guess you get to go free forever."
- Zak 9y ago
  If I was designing a remote lockdown procedure to secure systems against a state, I would not design it such that local employees could unlock it without remote authorization, preferably from someone physically located in another legal jurisdiction.
  - Consultant32452 9y ago
    Congratulations, you just won an injunction from the court which requires you cease all business functions in the country until the data is provided.
    - Zak 9y ago
      And now that my lawyers and sysadmins have had the chance to review it, possibly challenge it and come up with a means to provide the data required without giving government agents unfettered access to my systems, I will comply.
      - Consultant32452 9y ago
        When you first replied I incorrectly assumed you were talking about refusing to ever comply with the warrant. But what you just described is exactly how it should go down.
        Zak 9y ago
        It's not hard to imagine scenarios in which pulling out of a country to avoid providing secret information to that country's government is rational. Canada attempting to collect taxes on Uber rides is not one of those scenarios.
        Consultant32452 9y ago
        Perhaps, but it's difficult to imagine you're not in violation of some other kinds of laws for which there is ample evidence, and/or that no one in your organization is willing to talk.
        Zak 9y ago
        Sure, and if I'm systematically violating local law, there might be international agreements that would get my home country to cooperate in an enforcement action against me. On the other hand, the local authorities might want user data that I hold in order to do something horrible to local users that my home country would not like to help them do. But I digress. I think we've established that we agree the original security procedure with a secure remote lockout is a good idea.
      - FireBeyond 9y ago
        I too, when faced with a search warrant from the police, often like to come up with a means where I give them what they want, or claim it doesn't exist, without giving them an opportunity to look around. They very much are understanding of this.
        Consultant32452 9y ago
        If you're just there to "look around" and don't already know exactly what you are expecting to find then you shouldn't have been given the warrant to begin with. This is a criminal investigation, not a fishing expedition.
        FireBeyond 9y ago
        Yeah, and the defenders of Uber's activities here are acting as if the warrant -was- a fishing warrant and wasn't properly scoped, when the validity of this assertion had zero to do with their decision to "Ripley" the office. It wasn't to prevent an overreaching warrant, it was to prevent -any- warrant from being meaningfully served.
        Consultant32452 9y ago
        It wasn't an attempt to prevent any warrant at all. It was an attempt to prevent the authorities from accessing data NOT COVERED BY A WARRANT. Once Uber's lawyers have reviewed the warrant they will instruct the sysadmins to provide the covered data in a clean way which doesn't expose extra data. Simple as that. Generally speaking warrants are not granted for "all of your data." Imagine if every time the authorities got a warrant for some data Google has about a particular suspect, Google would reveal all of its internal data about every user, all of Google's internal financial files, etc. That would be insane.
        Zak 9y ago
        It appears in this case, Uber has designed a system with exactly that result: the police do not punish the local staff for the remote lockdown, and cannot punish the overseas sysadmins who caused it.
- zcid 9y ago
  Can you point to a specific case where a defendant was coerced into decrypting some data? As far as I understand it, the 5th Amendment protects a citizen from such coercion. If you have a physical device such as a Yubikey that unlocks your laptop, the court can order it to be given over, but the requirement that you produce the key from your own memory seems to be a different story.
  - s73ver_ 9y ago
    The closest I can remember is there being a guy who was going through customs coming back to the US. His laptop was inspected, and he had left child porn open on the screen. The inspectors saw it. The guy quickly closed the laptop, causing it to sleep, and causing the disk encryption to kick in, requiring authentication. He was held in contempt when he refused to unlock the laptop. That is a slightly different situation, as the evidence had been seen, and was known to be in the suspect's possession.
    - Consultant32452 9y ago
      In another case a district judge ordered a Colorado woman to decrypt her laptop. The person did not have to reveal their password, as that might weirdly count as "testimony," but they did have to provide the unencrypted data. It was ruled that the act of production of data does not constitute testifying against yourself. https://en.wikipedia.org/wiki/Key_disclosure_law#United_States https://en.wikipedia.org/wiki/Key_disclosure_law#United_Stat...
  - Consultant32452 9y ago
    The warrant is not for the password, but for the unencrypted data. You do not have to reveal your password, technically, but you do have to provide access to the unencrypted data. Since you do have access to the data, but refuse to provide it, you are failing to comply with the warrant. There are two cases referenced in this wiki page which are relevant if you're curious. https://en.wikipedia.org/wiki/Key_disclosure_law#United_States https://en.wikipedia.org/wiki/Key_disclosure_law#United_Stat...
  - jsjohnst 9y ago
- mcguire 9y ago
  Like Apple?
sova 9y ago
And shredders. Let's not forget Enron :D
mcguire 9y ago
Like Apple?

by Bud 9y ago

Consultant32452 9y ago

In the US at least you can be held in contempt and jailed indefinitely for not providing the decryption keys. Presumably other countries have mechanisms to deal with this beyond, "Oh gee, you password protected it, guess you get to go free forever."

Zak 9y ago
If I was designing a remote lockdown procedure to secure systems against a state, I would not design it such that local employees could unlock it without remote authorization, preferably from someone physically located in another legal jurisdiction.
- Consultant32452 9y ago
  Congratulations, you just won an injunction from the court which requires you cease all business functions in the country until the data is provided.
  - Zak 9y ago
    And now that my lawyers and sysadmins have had the chance to review it, possibly challenge it and come up with a means to provide the data required without giving government agents unfettered access to my systems, I will comply.
    - Consultant32452 9y ago
      When you first replied I incorrectly assumed you were talking about refusing to ever comply with the warrant. But what you just described is exactly how it should go down.
      - Zak 9y ago
        It's not hard to imagine scenarios in which pulling out of a country to avoid providing secret information to that country's government is rational. Canada attempting to collect taxes on Uber rides is not one of those scenarios.
        Consultant32452 9y ago
        Perhaps, but it's difficult to imagine you're not in violation of some other kinds of laws for which there is ample evidence, and/or that no one in your organization is willing to talk.
        Zak 9y ago
        Sure, and if I'm systematically violating local law, there might be international agreements that would get my home country to cooperate in an enforcement action against me. On the other hand, the local authorities might want user data that I hold in order to do something horrible to local users that my home country would not like to help them do. But I digress. I think we've established that we agree the original security procedure with a secure remote lockout is a good idea.
    - FireBeyond 9y ago
      I too, when faced with a search warrant from the police, often like to come up with a means where I give them what they want, or claim it doesn't exist, without giving them an opportunity to look around. They very much are understanding of this.
      - Consultant32452 9y ago
        If you're just there to "look around" and don't already know exactly what you are expecting to find then you shouldn't have been given the warrant to begin with. This is a criminal investigation, not a fishing expedition.
        FireBeyond 9y ago
        Yeah, and the defenders of Uber's activities here are acting as if the warrant -was- a fishing warrant and wasn't properly scoped, when the validity of this assertion had zero to do with their decision to "Ripley" the office. It wasn't to prevent an overreaching warrant, it was to prevent -any- warrant from being meaningfully served.
        Consultant32452 9y ago
        It wasn't an attempt to prevent any warrant at all. It was an attempt to prevent the authorities from accessing data NOT COVERED BY A WARRANT. Once Uber's lawyers have reviewed the warrant they will instruct the sysadmins to provide the covered data in a clean way which doesn't expose extra data. Simple as that. Generally speaking warrants are not granted for "all of your data." Imagine if every time the authorities got a warrant for some data Google has about a particular suspect, Google would reveal all of its internal data about every user, all of Google's internal financial files, etc. That would be insane.
      - Zak 9y ago
        It appears in this case, Uber has designed a system with exactly that result: the police do not punish the local staff for the remote lockdown, and cannot punish the overseas sysadmins who caused it.
zcid 9y ago
Can you point to a specific case where a defendant was coerced into decrypting some data? As far as I understand it, the 5th Amendment protects a citizen from such coercion. If you have a physical device such as a Yubikey that unlocks your laptop, the court can order it to be given over, but the requirement that you produce the key from your own memory seems to be a different story.
- s73ver_ 9y ago
  The closest I can remember is there being a guy who was going through customs coming back to the US. His laptop was inspected, and he had left child porn open on the screen. The inspectors saw it. The guy quickly closed the laptop, causing it to sleep, and causing the disk encryption to kick in, requiring authentication. He was held in contempt when he refused to unlock the laptop. That is a slightly different situation, as the evidence had been seen, and was known to be in the suspect's possession.
  - Consultant32452 9y ago
    In another case a district judge ordered a Colorado woman to decrypt her laptop. The person did not have to reveal their password, as that might weirdly count as "testimony," but they did have to provide the unencrypted data. It was ruled that the act of production of data does not constitute testifying against yourself. https://en.wikipedia.org/wiki/Key_disclosure_law#United_States https://en.wikipedia.org/wiki/Key_disclosure_law#United_Stat...
- Consultant32452 9y ago
  The warrant is not for the password, but for the unencrypted data. You do not have to reveal your password, technically, but you do have to provide access to the unencrypted data. Since you do have access to the data, but refuse to provide it, you are failing to comply with the warrant. There are two cases referenced in this wiki page which are relevant if you're curious. https://en.wikipedia.org/wiki/Key_disclosure_law#United_States https://en.wikipedia.org/wiki/Key_disclosure_law#United_Stat...
- jsjohnst 9y ago
mcguire 9y ago
Like Apple?

sova 9y ago

And shredders. Let's not forget Enron :D

mcguire 9y ago

Like Apple?