4 ms·

How is chain of custody maintained if the process is a secret? Couldn't a person argue that the data obtained was planted?

wmf 9y ago
They'll probably drop the case if the defense points this out (seriously, look at Stingrays).
- Scoundreller 9y ago
  But not so much for breathalyzers...
  - craftyguy 9y ago
    Breathalyzers will tell you what's up right on the spot, unless you've come across some that require the cops to collect a jar of your breath for processing at some remote discrete location?
    - peterwwillis 9y ago
      Breathalyzers are easily tampered with by police to provide false readings. One case of this in New Jersey could have potentially thrown out 20,000 DWI cases. But breathalyzer results in cases today are not thrown out after pointing this out.
      - craftyguy 9y ago
        > after pointing this out. What would you say, exactly? If you said: "your honor, breathalyzers can be tampered with to provide false readings" It seems quite easy for anyone to respond with "how so?". Do you refer to "this one time in New Jersey"?
        peterwwillis 9y ago
        Are you asking me to explain how trial law works?
        jfoutz 9y ago
        i have an expert that can explain various methods. Also, please release the device for the defenses inspection.
        letsgetphysITal 9y ago
        The prosecution will present calibration logs and security tampering prevention information to show that the device was independently verified as working correctly and demonstrably unchanged from that inspection date. A lot of people's careers rely on those records being correct, up to including a perjury charge if they're falsified.
        jfoutz 9y ago
        IANAL. I had this talk with a lawyer friend a few weeks ago. I thought there was a way to show the design of the device is faulty - for example a speed gun at sunset reports inaccurate times. But it's a very high standard to get a court to allow that.
      - gamblor956 9y ago
        It's irrelevant that breathalyzers in New Jersey were tampered with. You would need to show evidence that the breathalyzer in your specific case was tampered with. It's a basic rule of evidence...
        ndespres 9y ago
        In this case, a few breathalyzers were not calibrated correctly, but the officer responsible for testing them claimed to have done so. Now every device and calibration procedure is called into question, as their results may not be as verifiably precise as required by law. The device itself is not claimed to have been tampered with. http://www.nj.com/politics/index.ssf/2017/10/20k_dwi_cases_could_be_tossed_amid_state_police_pr.html http://www.nj.com/politics/index.ssf/2017/10/20k_dwi_cases_c...
      - ollie87 9y ago
        That why where I live if you trigger the drink driving limit on a breathalyzer you're driven to the station where a medical professional will take your blood and send it to an independent lab.
- TylerE 9y ago
  Or they just do parallel construction. They gather the evidence illegally, and the conjure up a legal means to re-find the evidence they already know exists.
  - Chriky 9y ago
    What here is illegally gathered?
    - cryoshon 9y ago
      let's say you need a warrant to get X. you use illegal methods to get X without a warrant. but you can't use that information legally. so you use your knowledge of X to find a legal way of learning X, after the fact. then you go to the courts saying you found X the legal way. but you didn't.
      - Chriky 9y ago
        I understand the theory thanks, I'm just disputing that this scenario is anything other than exceptionally rare. Parallel construction is used to protect sensitive sources, not cover up illegality.
    - veidr 9y ago
      Nothing, if they have a warrant (or equivalent legal authorization). But the reason most of us care about having our data encrypted is not actually because we are committing heinous felonies, and want our phones to hide the evidence from legitimate cops (though of course sometimes that’s the case). It’s because we don’t trust the authorities to follow the law. If they can crack your phone legally, they can also crack it illegally. (Say, after seizing it within 100 miles of the border, which they can do any time they please for whatever reason (including no real reason)). So even though this ability isn’t necessarily illegal in and of itself, it’s certainly of interest to those of us who are concerned about the threat vectors that are presented by government forces that do engage in illegal practices.
      - 9y ago
wahern 9y ago
Even if you can't authenticate evidence (chain of custody, disclosure of technical process, etc), you can still use the fruits of the analysis as long as acquisition of the phone wasn't illegal and the fruits can be proven independently after the fact. I imagine that in most situations law enforcement can make their case once information on the phone points them in the right direction, especially in high-profile cases where the government would spend a lot of money on a secret process. Authentication is necessary because the prosecutor has the burden of proof, and part of meeting that burden of proof is making a facially sound case about the authenticity and reliability of each piece of evidence. But unlike, say, an illegal search, failure to meet that burden doesn't poison derivative evidence as long as that evidence is independently submissible. Importantly, you don't need to authenticate evidence _before_ getting a warrant to take possession of the phone; at least not to the extent required at trial. And as far as I know there are no laws limiting how the government can extract information from a phone it legally possesses for investigatory purposes, which means any technical process would be entirely irrelevant to the legality of the search. So there's no way to force the government to divulge the process as long as they don't try to submit the information gained by that process directly as evidence. But maybe I'm missing something.
jaclaz 9y ago
>How is chain of custody maintained if the process is a secret? Couldn't a person argue that the data obtained was planted? Well this is a more general issue (I mean not limited to this case or to sending a device to Cellebrite or to another external laboratory) once a chain of custody is formally valid, it has as much integrity as the integrity of the people that had physical access to or worked on the device. Still - thankfully - "planting" evidence on a modern file system and OS (provided that the end result is an actual physical extraction) is not as easy as it may seem. Definitely possible, but extremely difficult to achieve without leaving any trace behind.
beagle3 9y ago
by the time anyone would challenge in court how an iOS 11 was broken, Apple would have released iOS 15, and the iOS 11 exploit would be public knowledge.
dep_b 9y ago
Other articles stated the unlock could also be performed on premises for a hefty sum.

wmf 9y ago

They'll probably drop the case if the defense points this out (seriously, look at Stingrays).

Scoundreller 9y ago
But not so much for breathalyzers...
- craftyguy 9y ago
  Breathalyzers will tell you what's up right on the spot, unless you've come across some that require the cops to collect a jar of your breath for processing at some remote discrete location?
  - peterwwillis 9y ago
    Breathalyzers are easily tampered with by police to provide false readings. One case of this in New Jersey could have potentially thrown out 20,000 DWI cases. But breathalyzer results in cases today are not thrown out after pointing this out.
    - craftyguy 9y ago
      > after pointing this out. What would you say, exactly? If you said: "your honor, breathalyzers can be tampered with to provide false readings" It seems quite easy for anyone to respond with "how so?". Do you refer to "this one time in New Jersey"?
      - peterwwillis 9y ago
        Are you asking me to explain how trial law works?
      - jfoutz 9y ago
        i have an expert that can explain various methods. Also, please release the device for the defenses inspection.
        letsgetphysITal 9y ago
        The prosecution will present calibration logs and security tampering prevention information to show that the device was independently verified as working correctly and demonstrably unchanged from that inspection date. A lot of people's careers rely on those records being correct, up to including a perjury charge if they're falsified.
        jfoutz 9y ago
        IANAL. I had this talk with a lawyer friend a few weeks ago. I thought there was a way to show the design of the device is faulty - for example a speed gun at sunset reports inaccurate times. But it's a very high standard to get a court to allow that.
    - gamblor956 9y ago
      It's irrelevant that breathalyzers in New Jersey were tampered with. You would need to show evidence that the breathalyzer in your specific case was tampered with. It's a basic rule of evidence...
      - ndespres 9y ago
        In this case, a few breathalyzers were not calibrated correctly, but the officer responsible for testing them claimed to have done so. Now every device and calibration procedure is called into question, as their results may not be as verifiably precise as required by law. The device itself is not claimed to have been tampered with. http://www.nj.com/politics/index.ssf/2017/10/20k_dwi_cases_could_be_tossed_amid_state_police_pr.html http://www.nj.com/politics/index.ssf/2017/10/20k_dwi_cases_c...
    - ollie87 9y ago
      That why where I live if you trigger the drink driving limit on a breathalyzer you're driven to the station where a medical professional will take your blood and send it to an independent lab.
TylerE 9y ago
Or they just do parallel construction. They gather the evidence illegally, and the conjure up a legal means to re-find the evidence they already know exists.
- Chriky 9y ago
  What here is illegally gathered?
  - cryoshon 9y ago
    let's say you need a warrant to get X. you use illegal methods to get X without a warrant. but you can't use that information legally. so you use your knowledge of X to find a legal way of learning X, after the fact. then you go to the courts saying you found X the legal way. but you didn't.
    - Chriky 9y ago
      I understand the theory thanks, I'm just disputing that this scenario is anything other than exceptionally rare. Parallel construction is used to protect sensitive sources, not cover up illegality.
  - veidr 9y ago
    Nothing, if they have a warrant (or equivalent legal authorization). But the reason most of us care about having our data encrypted is not actually because we are committing heinous felonies, and want our phones to hide the evidence from legitimate cops (though of course sometimes that’s the case). It’s because we don’t trust the authorities to follow the law. If they can crack your phone legally, they can also crack it illegally. (Say, after seizing it within 100 miles of the border, which they can do any time they please for whatever reason (including no real reason)). So even though this ability isn’t necessarily illegal in and of itself, it’s certainly of interest to those of us who are concerned about the threat vectors that are presented by government forces that do engage in illegal practices.
    - 9y ago

wahern 9y ago

Even if you can't authenticate evidence (chain of custody, disclosure of technical process, etc), you can still use the fruits of the analysis as long as acquisition of the phone wasn't illegal and the fruits can be proven independently after the fact. I imagine that in most situations law enforcement can make their case once information on the phone points them in the right direction, especially in high-profile cases where the government would spend a lot of money on a secret process. Authentication is necessary because the prosecutor has the burden of proof, and part of meeting that burden of proof is making a facially sound case about the authenticity and reliability of each piece of evidence. But unlike, say, an illegal search, failure to meet that burden doesn't poison derivative evidence as long as that evidence is independently submissible. Importantly, you don't need to authenticate evidence _before_ getting a warrant to take possession of the phone; at least not to the extent required at trial. And as far as I know there are no laws limiting how the government can extract information from a phone it legally possesses for investigatory purposes, which means any technical process would be entirely irrelevant to the legality of the search. So there's no way to force the government to divulge the process as long as they don't try to submit the information gained by that process directly as evidence. But maybe I'm missing something.

jaclaz 9y ago

>How is chain of custody maintained if the process is a secret? Couldn't a person argue that the data obtained was planted? Well this is a more general issue (I mean not limited to this case or to sending a device to Cellebrite or to another external laboratory) once a chain of custody is formally valid, it has as much integrity as the integrity of the people that had physical access to or worked on the device. Still - thankfully - "planting" evidence on a modern file system and OS (provided that the end result is an actual physical extraction) is not as easy as it may seem. Definitely possible, but extremely difficult to achieve without leaving any trace behind.

beagle3 9y ago

by the time anyone would challenge in court how an iOS 11 was broken, Apple would have released iOS 15, and the iOS 11 exploit would be public knowledge.

dep_b 9y ago

Other articles stated the unlock could also be performed on premises for a hefty sum.