4 ms·

But encrypted conversations, by definition, are recorded. With a warrant, law enforcement is permitted to search a safe containing written records of a convers

But encrypted conversations, by definition, are recorded. With a warrant, law enforcement is permitted to search a safe containing written records of a conversation; why shouldn't they be allowed to search an encrypted consumer electronic device containing the same?

RussianCow 6y ago
The difference is that a safe can be "brute forced"; you don't need to know the combination in order to be able to get in, with enough resources (i.e. a large enough drill). The same cannot be said about encrypted data, which is (as far as we know) literally impossible to break into no matter how much money you throw at the problem. If the same were true of safes—if they were physically impossible to get into without the key—then this same conversation would apply. Do you think, in that scenario, that safe manufacturers should be required to make a master key and distribute it to law enforcement? IANAL, but as far as I know, if the police can't physically break into your safe, there is nothing saying that they have any legal recourse to compel you to open it. Why should encrypted data be any different? Any why should it be the responsibility of the manufacturer/service provider to supply law enforcement with a key? The government can always pass a law allowing law enforcement to legally require you to unlock your device, but that is not what they are doing.
- happythomist 6y ago
  > Do you think, in that scenario, that safe manufacturers should be required to make a master key and distribute it to law enforcement? I'm not sure, to be honest, but I think it's certainly a reasonable position to take. > IANAL, but as far as I know, if the police can't physically break into your safe, there is nothing saying that they have any legal recourse to compel you to open it. If it can be established that the safe is yours and that you possess the key or know the combination, I believe a court can indeed order you to open it or to produce the contents, punishable by contempt of court. > Any why should it be the responsibility of the manufacturer/service provider to supply law enforcement with a key? Because the state has a compelling public interest in ensuring that law enforcement can successfully execute lawful search warrants. The existence of indestructible safes would constitute a significant impediment to achieving that goal, so manufacturers of such safes have the responsibility of ensuring that law enforcement can access them. I don't necessarily agree with that argument, but I don't think it's unreasonable.
  - RussianCow 6y ago
    > If it can be established that the safe is yours and that you possess the key or know the combination, I believe a court can indeed order you to open it or to produce the contents, punishable by contempt of court. I got curious about this, so I did some quick research. Again, IANAL, but my understanding is that, in the US, the court can order you to give up the physical key (if it is determined that you have it) but not the combination. The latter is protected by the Fifth Amendment right against self incrimination, in the same way as sharing knowledge verbally. So then the question becomes, is an encryption key (or passcode, etc) more like a physical key, or a combination? If the former, then you would be legally compelled to decrypt it if law enforcement asked you to do so. If the latter, however, then there is no legal way for law enforcement to force you to decrypt the device. The legal framework for deciding how to handle encrypted data already exists, it's just ambiguous. Instead of passing a law that completely changes the scope and usefulness of encryption, doesn't it make much more sense to simply disambiguate and update existing laws accordingly? I don't know the full repercussions of that, but it seems that there exist less drastic solutions to the problem. > I don't necessarily agree with that argument, but I don't think it's unreasonable. I think it is unreasonable because it's asking companies to willfully violate their user's privacy and trust, and to severely undermine encryption as a whole. There is zero chance that this does not get abused.
    - happythomist 6y ago
      > The latter is protected by the Fifth Amendment right against self incrimination, in the same way as sharing knowledge verbally. ... If the latter, however, then there is no legal way for law enforcement to force you to decrypt the device. Not exactly. Yes, revealing the combination requires the person to implicitly admit that they know the what the combination is. But if the government can prove that they already know this "testimony" -- which they can in most cases -- then the "foregone conclusion" doctrine applies and the 5th Amendment privilege cannot be asserted. See, for example, the Massachusetts Supreme Court's decision in Commonwealth v. Jones. [1] There is also conflicting 11th Circuit precedent that further requires the government to establish with "reasonable particularity" what is on the encrypted device. [2] In my opinion this is not correct; the contents of the drive have nothing to do with the testimonial value of the combination. In any event, this issue will eventually need to be resolved at the Supreme Court. > I think it is unreasonable because it's asking companies to willfully violate their user's privacy and trust, and to severely undermine encryption as a whole. There is zero chance that this does not get abused. I don't see how it violates user privacy or trust. In general, you don't have the right to keep records secure from law enforcement if they have a warrant. If this law is passed, these companies should simply disclose to their customers that they will provide law enforcement with the means to decrypt their data, as many already do. I also don't see how it severely undermines encryption. Yes, end-to-end encryption is more secure, but it's not the industry norm. Security is relative, but I wouldn't call Gmail "insecure" just because Google allows law enforcement to read emails with a warrant. [1] https://www.socialaw.com/services/slip-opinions/slip-opinion-details/commonwealth-vs.-dennis-jones https://www.socialaw.com/services/slip-opinions/slip-opinion... [2] https://www.eff.org/files/filenode/opiniondoe22312.pdf https://www.eff.org/files/filenode/opiniondoe22312.pdf
- fastball 6y ago
  If impenetrable safes existed, the government stance would certainly not just be to say "oh well, guess we gotta let criminals store whatever contraband they want".
  - RussianCow 6y ago
    Sure, but don't you think there are less drastic solutions than to require the manufacturer to create a master key, distribute it to law enforcement, and cross their fingers hoping that it doesn't get exploited?
    - fastball 6y ago
      I mean, what would the less drastic solution be in this analogy?
      - RussianCow 6y ago
        Pass a law that would allow law enforcement to legally require you to open the safe, just like they can currently compel you to hand over a physical key.

RussianCow 6y ago

The difference is that a safe can be "brute forced"; you don't need to know the combination in order to be able to get in, with enough resources (i.e. a large enough drill). The same cannot be said about encrypted data, which is (as far as we know) literally impossible to break into no matter how much money you throw at the problem. If the same were true of safes—if they were physically impossible to get into without the key—then this same conversation would apply. Do you think, in that scenario, that safe manufacturers should be required to make a master key and distribute it to law enforcement? IANAL, but as far as I know, if the police can't physically break into your safe, there is nothing saying that they have any legal recourse to compel you to open it. Why should encrypted data be any different? Any why should it be the responsibility of the manufacturer/service provider to supply law enforcement with a key? The government can always pass a law allowing law enforcement to legally require you to unlock your device, but that is not what they are doing.

happythomist 6y ago
> Do you think, in that scenario, that safe manufacturers should be required to make a master key and distribute it to law enforcement? I'm not sure, to be honest, but I think it's certainly a reasonable position to take. > IANAL, but as far as I know, if the police can't physically break into your safe, there is nothing saying that they have any legal recourse to compel you to open it. If it can be established that the safe is yours and that you possess the key or know the combination, I believe a court can indeed order you to open it or to produce the contents, punishable by contempt of court. > Any why should it be the responsibility of the manufacturer/service provider to supply law enforcement with a key? Because the state has a compelling public interest in ensuring that law enforcement can successfully execute lawful search warrants. The existence of indestructible safes would constitute a significant impediment to achieving that goal, so manufacturers of such safes have the responsibility of ensuring that law enforcement can access them. I don't necessarily agree with that argument, but I don't think it's unreasonable.
- RussianCow 6y ago
  > If it can be established that the safe is yours and that you possess the key or know the combination, I believe a court can indeed order you to open it or to produce the contents, punishable by contempt of court. I got curious about this, so I did some quick research. Again, IANAL, but my understanding is that, in the US, the court can order you to give up the physical key (if it is determined that you have it) but not the combination. The latter is protected by the Fifth Amendment right against self incrimination, in the same way as sharing knowledge verbally. So then the question becomes, is an encryption key (or passcode, etc) more like a physical key, or a combination? If the former, then you would be legally compelled to decrypt it if law enforcement asked you to do so. If the latter, however, then there is no legal way for law enforcement to force you to decrypt the device. The legal framework for deciding how to handle encrypted data already exists, it's just ambiguous. Instead of passing a law that completely changes the scope and usefulness of encryption, doesn't it make much more sense to simply disambiguate and update existing laws accordingly? I don't know the full repercussions of that, but it seems that there exist less drastic solutions to the problem. > I don't necessarily agree with that argument, but I don't think it's unreasonable. I think it is unreasonable because it's asking companies to willfully violate their user's privacy and trust, and to severely undermine encryption as a whole. There is zero chance that this does not get abused.
  - happythomist 6y ago
    > The latter is protected by the Fifth Amendment right against self incrimination, in the same way as sharing knowledge verbally. ... If the latter, however, then there is no legal way for law enforcement to force you to decrypt the device. Not exactly. Yes, revealing the combination requires the person to implicitly admit that they know the what the combination is. But if the government can prove that they already know this "testimony" -- which they can in most cases -- then the "foregone conclusion" doctrine applies and the 5th Amendment privilege cannot be asserted. See, for example, the Massachusetts Supreme Court's decision in Commonwealth v. Jones. [1] There is also conflicting 11th Circuit precedent that further requires the government to establish with "reasonable particularity" what is on the encrypted device. [2] In my opinion this is not correct; the contents of the drive have nothing to do with the testimonial value of the combination. In any event, this issue will eventually need to be resolved at the Supreme Court. > I think it is unreasonable because it's asking companies to willfully violate their user's privacy and trust, and to severely undermine encryption as a whole. There is zero chance that this does not get abused. I don't see how it violates user privacy or trust. In general, you don't have the right to keep records secure from law enforcement if they have a warrant. If this law is passed, these companies should simply disclose to their customers that they will provide law enforcement with the means to decrypt their data, as many already do. I also don't see how it severely undermines encryption. Yes, end-to-end encryption is more secure, but it's not the industry norm. Security is relative, but I wouldn't call Gmail "insecure" just because Google allows law enforcement to read emails with a warrant. [1] https://www.socialaw.com/services/slip-opinions/slip-opinion-details/commonwealth-vs.-dennis-jones https://www.socialaw.com/services/slip-opinions/slip-opinion... [2] https://www.eff.org/files/filenode/opiniondoe22312.pdf https://www.eff.org/files/filenode/opiniondoe22312.pdf
fastball 6y ago
If impenetrable safes existed, the government stance would certainly not just be to say "oh well, guess we gotta let criminals store whatever contraband they want".
- RussianCow 6y ago
  Sure, but don't you think there are less drastic solutions than to require the manufacturer to create a master key, distribute it to law enforcement, and cross their fingers hoping that it doesn't get exploited?
  - fastball 6y ago
    I mean, what would the less drastic solution be in this analogy?
    - RussianCow 6y ago
      Pass a law that would allow law enforcement to legally require you to open the safe, just like they can currently compel you to hand over a physical key.