6 ms·

Sure, but I can just refuse to decrypt my data. They can just break physical locks.

• javagram 7y ago
  Refusing to decrypt is itself a crime (contempt of court?), so the government can jail you for years that way. Edit: this doesn’t help in cases like terrorism where the owner of the device has already been killed of course.
  • lisper 7y ago
    This situation also has an analogy in the physical world: if the owner of the key is dead or otherwise non-coercible, that's effectively the same as a physical document being destroyed.
  • mbrumlow 7y ago
    I am not sure you can be compelled to remember something you forgot. And nobody can tell you if you remember or not, or if you will ever remember again. So no, some judge may try to hold you in contempt of court, and it may work for a while, but at some point -- if you have a good lawyer it will turn in to a civil rights issue. Also, you could plead the 5th as well. NOTE: I am not a lawyer, and these are just my opinions on this matter.
    • ilikehurdles 7y ago
      https://arstechnica.com/tech-policy/2017/03/man-jailed-indefinitely-for-refusing-to-decrypt-hard-drives-loses-appeal/ https://arstechnica.com/tech-policy/2017/03/man-jailed-indef...
      • snuxoll 7y ago
        It’s important to point out in this case the stated reason for the contempt charge is the “foregone conclusion” that there IS child porn on those encrypted drives, not the mere existence of encrypted drives with what could contain anything. Police can’t compel you to provide a combination to a lock (encryption key) to go on a fishing expedition, but if they KNOW the safe contains illegal contents then you can be held in contempt for not providing it (they already know it’s in there). Without spending forever delving into the case record I can’t comment on whether they should really have a high enough certainty that the drive does contain CP, but the argument in this specific case does match our interpretation of the 5th amendment when it comes to physical locks. This is a good argument WHY encryption is important, however. Backdooring crypto would allow law enforcement to fish through everything they want with wanton disregard for the fifth amendment, instead of needing to build up a suitable case for illegal acts being committed with standard investigatory techniques. This right here is how the system SHOULD work.
        • Canada 7y ago
          If the prosecution has such convincing evidence that the drives contain the images they say, then why do they need to compel the defendant to do anything at all? If it's such a foregone conclusion, why not just go ahead and try him on the child porn charge?
          • snuxoll 7y ago
            Dunno, I’m just an armchair lawyer who watches too many Leonard French videos. Like I said in my original comment, I haven’t read the case record in detail, nor am I familiar enough with the Federal Rules or Criminal Procedure to know if there’s some evidentiary requirement they cannot meet without the contents of the drive or whatever. I’m guessing it’s because they are operating off testimony of a witness (defendants sister) claiming she was shown the alleged images, and since they weren’t on the unencrypted internal drive they MUST be on the encrypted external drives. That combined with the knowledge that these files were in fact purportedly known to be downloaded via his internet connection is enough for something, but all they have without the drives is hearsay, hence the compulsion to decrypt then? Personally I think in this instance with recent rulings that an individual cannot be identified by an IP address and a single witness that there isn’t enough to KNOW anything, otherwise I could wardrive around, download a bunch of CP on somebodies connection and say I saw them looking at it through a window or something. All I know is that we do have precedent for this in the physical world, so it’s not a logical leap to require disclosure of cryptographic keys when we KNOW what they unlock.
            • Canada 7y ago
              I just don't buy that argument. If the evidence is mere hearsay, then how could it be good enough for compelling him to testify against himself? It isn't hearsay in this case though. Hearsay is when Alice testifies that Bob told her he witnessed Charlie viewing child porn. Generally it should not be considered as fact that Bob witnessed this. It's not hearsay if Alice testifies that she witnessed Charlie viewing child porn, which seems to be the case here. This kind of testimony is direct evidence. Then there is the circumstantial evidence: The prosecution can show these encrypted drives exist, belong to the defendant, that he knows how to decrypt them and refused, etc. I just don't see how it's reasonable to claim that isn't good enough for a jury to decide who to believe. They should just try him, or let him go.
    • btouellette 7y ago
      Courts have ruled that providing a password to decrypt something is not in itself testimony and isn't protected by the 5th amendment. Judges can certainly hold you in court indefinitely on a contempt of court charge as well. Considering the nature of the charges that this typically comes up in (see Francis Rawls) I wouldn't count on trying to make it a civil rights issue doing much in your favor.
      • russdpale 7y ago
        But what if someone really does forget the key? They are just jailed forever?
      • jki275 7y ago
        Other courts have ruled the other way on that. It is not settled law.
• daxorid 7y ago
  It's increasingly difficult to do this without incurring contempt from our bootlicking judiciary. You're gambling on the temperament of your judge if you do this.
• slg 7y ago
  This is what a lot of people in our community seemingly refuse to recognize. For all intents and purposes, encryption is a unbreakable lock that can serve to perfectly hide valuable criminal evidence. Such a thing wasn't possible when our laws were written and has never before been possible in the physical world. Its existence has potential to be a huge shift in how we enforce the law. Regardless of our views on encryption, we need to have a conversation about that shift. Refusing to have that discussion is likely a quicker path to things like government enforced backdoors than if we engaged with government and law enforcement on possible alternatives.
  • core-questions 7y ago
    The problem is that there's no way for the government to actually enforce this 100% - sure, on the average person, but we have to assume that someone engaged in espionage / terrorism / etc. is going to take additional precautions. The threat doesn't go away by doing this.
    • prpp0ndj 7y ago
      Yeah you get the majority easy enough. They’re mostly law abiding anyway, so you conjure up as much petty crap to pin on them to justify the police state. Meanwhile the connected and savvy minority coddle pedophiles and grifters among their lot. These are not really new concerns or ideas. The context has shifted from “meatspace” to “cyber space”. Generally the old ideas of trust and verify, avoid unenforceable, spurious, overreach still apply. There’s an interesting parallel to the Pareto principle here, IMO. Society is pushing for more and more policing of the 80%ish and less on the 20%ish. Wealth inequality, and civil rights inequality, filter into our tech contexts. Too bad we largely focus on these things in our favored context rather than see it as the general political plight of the masses, as it really should be considered, IMO.
    • acdha 7y ago
      Nothing assumes 100% perfection as a requirement. We might not like it but if, say, popular services had a way to satisfy warrant requests that would mean that most cases would be satisfied with a warrant even if a small percentage required something else, just as the existence of very hard to open safes doesn’t mean most criminals use them. To be clear, I’m opposed to widespread access and would want a warrant at a minimum but honesty compels me to note that there are crimes which would be solved if someone used, say, SMS but not Signal and we should consciously accept that as the cost of not living in a surveillance state rather than pretending it’s not true.
• cptskippy 7y ago
  And when a physical lock is broken it's known by anyone who can observe the lock. When a decryption has a backdoor, who knows when it's been decrypted?
• mattnewton 7y ago
  Sure, you can also destroy evidence! This is already a crime we deal with. Encrypting and throwing away the key is deleting with more steps - in fact it is often an implementation detail of deletion in some software systems. It is already illegal, and already something our justice system deals with. No power grabs necessary.
  • AnthonyMouse 7y ago
    > Sure, you can also destroy evidence! This is already a crime we deal with. That is just assuming the premise. Destruction of evidence is a crime, but destruction of private lawful communications is not. The FBI has no right to a married couple's sexting. The usual case for destruction of evidence is one of two things. Either they produce some emails where you're conspiring to destroy evidence, or that they catch you in the act, seize the evidence you were destroying, and then use it to prove that what you were destroying was evidence. Finding someone with a bucket full of confetti or an encrypted drive but no key isn't evidence of a crime, and it's unreasonable to be able to put anybody in jail just because they shredded their old credit card statements or can't remember the password for an old device that has been in a closet for three years.
    • mattnewton 7y ago
      The fact that the FBI has no right to a couple sexting without a warrant is exactly why encryption is fine. When they present evidence to a judge that there is something they need in those conversations to prove a crime, and get a warrant, then it becomes evidence in a criminal investigation. IANAL or law enforcement, but I don’t see the problem with this system.
      • AnthonyMouse 7y ago
        The problem is that you may not be able to decrypt it. It's like finding some footage that you drove into and out of a place where there was a murdered body during the same time that the body went missing. That's circumstantial evidence you might have moved it, and it might convince a judge to issue a warrant and have the police search your residence for evidence. But if they can't find anything it's not reasonable to charge you with destruction of evidence for not producing the body, because they haven't proved beyond a reasonable doubt that you could have. People forget passwords all the time. Sometimes the police find the phone of somebody else who left it in your car and you didn't even realize it was there, and now you think they planted it and they think you won't unlock it, and the person who knows their phone is missing would rather see you in jail than claim the phone and end up there themselves. Higher level paranoia security systems can make unused space indistinguishable from encrypted data, or send cover traffic when there is no real traffic, and there is no way to decrypt it because it's not actually encrypted data to begin with. There is no way to prove you can't decrypt something which means it's unreasonable to demand that somebody do it when they may not be able to.
• wjmao88 7y ago
  They can't force me to tell them where I've physically hid things.
• rndgermandude 7y ago
  Encryption is nothing like a lock. We should stop using that analogy. Encryption relies on a secret. It's like burying a treasure in a place only you know, and keeping the location a secret (e.g. in your head). Encryption just gives you a huge digital space where you can bury your treasure instead of a physical space where you can bury it. Sure, people can just search everywhere for your pirate gold (brute-force attack), use advanced reasoning to narrow the search space, like "you lacked the means to 'bury' it in solid stone" (cryptanalysis), develop technology to speed up the search like ground-penetrating radar (e.g. GPUs, asic, special purpose programs) or try to coerce you to reveal the location (monkeywrench-to-knee passphrase cracking). What the governments wants is that the maker of the shovel you used to bury your treasure not only has to track where you took that shovel but also has to tell the government that information without you telling the government got the information.
• puzzledobserver 7y ago
  I wonder whether there is any work on plausibly deniable public key cryptography. The sender uses the public key to encrypt the plaintext, and the receiver uses their private key to decipher the ciphertext, as usual. But, on being compelled, the receiver can also choose an arbitrary target plaintext, and efficiently compute a new private key that maps the ciphertext to the chosen target plaintext.
  • dmitrygr 7y ago
    Take a look at this: https://en.wikipedia.org/wiki/Off-the-Record_Messaging https://en.wikipedia.org/wiki/Off-the-Record_Messaging It is designed for that, and more. In fact, it does not leave the theoretical "anyone could fake the logs", they created a tool to do so, so that you do not need an expert witness to explain to court that someone could doctor the logs - a tool exists for it. On purpose. They call it Deniable authentication: > Messages in a conversation do not have digital signatures, and after a conversation is complete, anyone is able to forge a message to appear to have come from one of the participants in the conversation, assuring that it is impossible to prove that a specific message came from a specific person. Within the conversation the recipient can be sure that a message is coming from the person they have identified.