4 ms·

My company responds to subpoenas with a wiki article on how client side encryption works

by gammateam 8y ago

msla 8y ago
And if the judge is feeling especially generous, they'll respond to you with a Wikipedia article on contempt of court.
- exolymph 8y ago
  No, because the point of client-side encryption is that the service provider does not have the data to hand over.
  - etskinner 8y ago
    I think the point is, if all they sent was a wiki article, they wouldn't be responding to the spirit of the subpoena. Instead they'd be expected to write up an explanation that they don't keep full data, and they would probably still be required to hand over metadata that might be useful.
    - danso 8y ago
      And to be fair, the original commenter didn’t say that the only thing sent was the wiki article. It might be one of a dozen URLs included in the company’s reply boilerplate.
jdc 8y ago
What stops your users from getting subpoenaed via their ISPs?
- saagarjha 8y ago
  Presumably, their users have the right to not incriminate themselves.
  - jkaplowitz 8y ago
    The US right against self-incrimination does not protect against being required to provide records which already exist. It only protects against being required to give incriminating statements of a testimonial nature. As an extremely contrived example, if you've spontaneously written a confession to a crime and the cops learn of this, they can subpoena you and order you to hand it over. But they can't just require you to write out a confession or speak one in court. (Cops do get people to confess, of course, but there is some element of persuasion and choice involved in that decision.) As a much more common example, with the right level of evidence to motivate this request they can require your fingerprints as part of a criminal investigation. This is true even if they do not arrest you and even if the fingerprints will incriminate you. But they can't require you to answer incriminating questions.
    - saagarjha 8y ago
      This doesn't work for client-side encryption, though–I cannot be forced to give up my keys or passwords.
      - jkaplowitz 8y ago
        Client-side encryption doesn't always solve this. Two main exceptions: First, if the encryption is unlocked by a physical device that doesn't require a memorized code, or by your personal biometrics, they can get that without violating your right against self-incrimination. Second, if they know what information is being hidden by the encryption and just need a copy of it to prove their case, the foregone conclusion doctrine lets them demand it anyway. (They are not demanding the key or password in this case, just a decrypted version of information they already know exists.) But sure, in other cases it can have the effect you say.
        rocqua 8y ago
        > Second, if they know what information is being hidden by the encryption and just need a copy of it to prove their case, the foregone conclusion doctrine lets them demand it anyway. Note that they are then not allowed to use the fact that you could unlock it against you.
citrablue 8y ago
This is a glib and unhelpful response. Does your company potentially have access to data that may be useful in a legal investigation? Do you provide server side voice recognition services as accurate as Alexa/Google? My company would respond to a similar subpoena by explaining that we make archery bows from wood. That also doesn't add anything to the HN discussion.
- pritambaral 8y ago
  > My company would respond to a similar subpoena by explaining that we make archery bows from wood. That also doesn't add anything to the HN discussion. I believe your parent's comment is relevant to this HN discussion, quite unlike your company's occupation. Your parent's comment suggests their company's users upload data (albeit encrypted client-side) to the company, so a judge could — without an understanding of client-side encryption — reasonably subpoena the company for user data. Compared to that, it is quite unlikely a judge would mistake a company that makes wooden archery bows for a company that collects much user data, or believe that the former fact has much to do with the latter supposition.

My company responds to subpoenas with a wiki article on how client side encryption works

msla 8y ago

And if the judge is feeling especially generous, they'll respond to you with a Wikipedia article on contempt of court.

exolymph 8y ago
No, because the point of client-side encryption is that the service provider does not have the data to hand over.
- etskinner 8y ago
  I think the point is, if all they sent was a wiki article, they wouldn't be responding to the spirit of the subpoena. Instead they'd be expected to write up an explanation that they don't keep full data, and they would probably still be required to hand over metadata that might be useful.
  - danso 8y ago
    And to be fair, the original commenter didn’t say that the only thing sent was the wiki article. It might be one of a dozen URLs included in the company’s reply boilerplate.

jdc 8y ago

What stops your users from getting subpoenaed via their ISPs?

saagarjha 8y ago
Presumably, their users have the right to not incriminate themselves.
- jkaplowitz 8y ago
  The US right against self-incrimination does not protect against being required to provide records which already exist. It only protects against being required to give incriminating statements of a testimonial nature. As an extremely contrived example, if you've spontaneously written a confession to a crime and the cops learn of this, they can subpoena you and order you to hand it over. But they can't just require you to write out a confession or speak one in court. (Cops do get people to confess, of course, but there is some element of persuasion and choice involved in that decision.) As a much more common example, with the right level of evidence to motivate this request they can require your fingerprints as part of a criminal investigation. This is true even if they do not arrest you and even if the fingerprints will incriminate you. But they can't require you to answer incriminating questions.
  - saagarjha 8y ago
    This doesn't work for client-side encryption, though–I cannot be forced to give up my keys or passwords.
    - jkaplowitz 8y ago
      Client-side encryption doesn't always solve this. Two main exceptions: First, if the encryption is unlocked by a physical device that doesn't require a memorized code, or by your personal biometrics, they can get that without violating your right against self-incrimination. Second, if they know what information is being hidden by the encryption and just need a copy of it to prove their case, the foregone conclusion doctrine lets them demand it anyway. (They are not demanding the key or password in this case, just a decrypted version of information they already know exists.) But sure, in other cases it can have the effect you say.
      - rocqua 8y ago
        > Second, if they know what information is being hidden by the encryption and just need a copy of it to prove their case, the foregone conclusion doctrine lets them demand it anyway. Note that they are then not allowed to use the fact that you could unlock it against you.

citrablue 8y ago

This is a glib and unhelpful response. Does your company potentially have access to data that may be useful in a legal investigation? Do you provide server side voice recognition services as accurate as Alexa/Google? My company would respond to a similar subpoena by explaining that we make archery bows from wood. That also doesn't add anything to the HN discussion.

pritambaral 8y ago
> My company would respond to a similar subpoena by explaining that we make archery bows from wood. That also doesn't add anything to the HN discussion. I believe your parent's comment is relevant to this HN discussion, quite unlike your company's occupation. Your parent's comment suggests their company's users upload data (albeit encrypted client-side) to the company, so a judge could — without an understanding of client-side encryption — reasonably subpoena the company for user data. Compared to that, it is quite unlikely a judge would mistake a company that makes wooden archery bows for a company that collects much user data, or believe that the former fact has much to do with the latter supposition.