5 ms·

Fifth amendment and encryption issues are already worked out. Just like you can be compelled to open a safe, you can be compelled to decrypt a volume. A self-

Fifth amendment and encryption issues are already worked out. Just like you can be compelled to open a safe, you can be compelled to decrypt a volume. A self-destroying drive would likely get you a conviction for obstructing justice, just like shredding the contents of a safe would.

benwr 15y ago
And what happens in the xkcd-inspired future where we all have neural interfaces to storage? When the lines between what's in our heads and what's written down are sufficiently blurred, what's obstruction of justice and what's a fifth-amendment right?
- bh42222 15y ago
  What about the now. What level of data protection counts as contempt or obstruction? What if I have provided the courts with all of the data, but for some reason they suspect there's more that I'm hiding? What if I honestly can not remember the password for some of my old data? Do I go to jail because my memory is gone?
deleted 15y ago
[deleted]
speckledjim 15y ago
A safe is obviously a safe. It obviously contains something. Encrypted data isn't so clear cut. It's trivial to make a datastore that has several encryption keys, so that you could give out one key, and it'd "decrypt" to some boring stuff, whilst keeping the real data, and the alternate key, secret. It'd also be trivial to devise a decryption algorithm, and key, which "decrypts" anyones hard drive to reveal illegal images even when none are really there... So I don't think it's a good analogy. It's quite obvious when you have successfully got into a safe, but how do you know when you have successfully decrypted something, to the real stuff that is important and being hidden in it?
- chc 15y ago
  Is it actually trivial to encrypt arbitrary text in such a way that it could be decrypted to the source text or a different but still meaningful alternate text? That sounds really hard to do. Is this indeed a solved problem and I just don't know about it?
  - lisper 15y ago
    It is trivial. Just encrypt the true plaintext and the alternate plaintext with separate keys and place the results in a container. To decrypt, try both ciphertexts and return the one that validly decrypts with the provided key.
    - windsurfer 15y ago
      Or better yes, 50'000 containers of varying sizes, 49'998 of which are filled with random data.
    - dedward 15y ago
      It's trivial cryptographically, but from a security point of view, it's not necessarily trivial at all. If we assume the courts can order you to decrypt the drive (and without debating that point) - one has to consider that the court may be fully aware that the system has multiple hidden volumes, either by eyewitness testimony, 3rd party evidence (check out truecrypt's warnings on their site about full system encryption and what to watch out for. Things like finding the same windows installation doing every update twice. There are all kinds of information leaks that COULD pop up. I'm not saying it's impossible - just as strong cryptography, which is easy and is all over, doesn't mean all our data is secure, neither would a more complex system like this protect someone from the legal system.
  - bhickey 15y ago
    The short answer on this is no. Check out unicity distance. http://en.wikipedia.org/wiki/Unicity_distance http://en.wikipedia.org/wiki/Unicity_distance
pittsburgh 15y ago
I wouldn't say this issue is fully "worked out" yet. Disclaimer: I am not a lawyer. Most of what I know about this is from the last twenty minutes of googling. In 2007 a federal judge ruled that passwords aren't like keys to a safe, and that the government can't force somebody to hand them over. (United States v. Boucher http://news.cnet.com/8301-13578_3-9834495-38.html http://news.cnet.com/8301-13578_3-9834495-38.html ) However, that decision was partially overruled in 2009. ( http://www.bennettandbennett.com/node/5608 http://www.bennettandbennett.com/node/5608 ) The judge ruled that the defendant didn't have to provide his password, but he did have to provide the contents on the hard drive. In other words, if the defendant happend to have an unencrypted copy of the hard drive hidden away somewhere he could have offered that in place of the password. Using your safe analogy, it would be like saying that you don't have to provide the government with the key to the safe, but you do have to provide them with an identical copy of everything contained within the safe. Now, like me you're probably wondering how the government could prove that the contents you provide from a secondary source really matches up with what's on the encrypted drive. The Boucher case mentioned above was unique because border control agents had already viewed the contents of the guy's laptop in unencrypted form, so they knew what to expect. (In his case, child porn.) From what I can find, there don't appear to be any laws in the U.S. (and no case law) which specifically require people to hand over their passwords at the government's request. Here are two more links I found which were helpful: http://volokh.com/files/BoucherDCT.1.pdf http://volokh.com/files/BoucherDCT.1.pdf and http://en.wikipedia.org/wiki/United_States_v._Boucher http://en.wikipedia.org/wiki/United_States_v._Boucher

benwr 15y ago

And what happens in the xkcd-inspired future where we all have neural interfaces to storage? When the lines between what's in our heads and what's written down are sufficiently blurred, what's obstruction of justice and what's a fifth-amendment right?

bh42222 15y ago
What about the now. What level of data protection counts as contempt or obstruction? What if I have provided the courts with all of the data, but for some reason they suspect there's more that I'm hiding? What if I honestly can not remember the password for some of my old data? Do I go to jail because my memory is gone?

deleted 15y ago

[deleted]

speckledjim 15y ago

A safe is obviously a safe. It obviously contains something. Encrypted data isn't so clear cut. It's trivial to make a datastore that has several encryption keys, so that you could give out one key, and it'd "decrypt" to some boring stuff, whilst keeping the real data, and the alternate key, secret. It'd also be trivial to devise a decryption algorithm, and key, which "decrypts" anyones hard drive to reveal illegal images even when none are really there... So I don't think it's a good analogy. It's quite obvious when you have successfully got into a safe, but how do you know when you have successfully decrypted something, to the real stuff that is important and being hidden in it?

chc 15y ago
Is it actually trivial to encrypt arbitrary text in such a way that it could be decrypted to the source text or a different but still meaningful alternate text? That sounds really hard to do. Is this indeed a solved problem and I just don't know about it?
- lisper 15y ago
  It is trivial. Just encrypt the true plaintext and the alternate plaintext with separate keys and place the results in a container. To decrypt, try both ciphertexts and return the one that validly decrypts with the provided key.
  - windsurfer 15y ago
    Or better yes, 50'000 containers of varying sizes, 49'998 of which are filled with random data.
  - dedward 15y ago
    It's trivial cryptographically, but from a security point of view, it's not necessarily trivial at all. If we assume the courts can order you to decrypt the drive (and without debating that point) - one has to consider that the court may be fully aware that the system has multiple hidden volumes, either by eyewitness testimony, 3rd party evidence (check out truecrypt's warnings on their site about full system encryption and what to watch out for. Things like finding the same windows installation doing every update twice. There are all kinds of information leaks that COULD pop up. I'm not saying it's impossible - just as strong cryptography, which is easy and is all over, doesn't mean all our data is secure, neither would a more complex system like this protect someone from the legal system.
- bhickey 15y ago
  The short answer on this is no. Check out unicity distance. http://en.wikipedia.org/wiki/Unicity_distance http://en.wikipedia.org/wiki/Unicity_distance

pittsburgh 15y ago

I wouldn't say this issue is fully "worked out" yet. Disclaimer: I am not a lawyer. Most of what I know about this is from the last twenty minutes of googling. In 2007 a federal judge ruled that passwords aren't like keys to a safe, and that the government can't force somebody to hand them over. (United States v. Boucher http://news.cnet.com/8301-13578_3-9834495-38.html http://news.cnet.com/8301-13578_3-9834495-38.html ) However, that decision was partially overruled in 2009. ( http://www.bennettandbennett.com/node/5608 http://www.bennettandbennett.com/node/5608 ) The judge ruled that the defendant didn't have to provide his password, but he did have to provide the contents on the hard drive. In other words, if the defendant happend to have an unencrypted copy of the hard drive hidden away somewhere he could have offered that in place of the password. Using your safe analogy, it would be like saying that you don't have to provide the government with the key to the safe, but you do have to provide them with an identical copy of everything contained within the safe. Now, like me you're probably wondering how the government could prove that the contents you provide from a secondary source really matches up with what's on the encrypted drive. The Boucher case mentioned above was unique because border control agents had already viewed the contents of the guy's laptop in unencrypted form, so they knew what to expect. (In his case, child porn.) From what I can find, there don't appear to be any laws in the U.S. (and no case law) which specifically require people to hand over their passwords at the government's request. Here are two more links I found which were helpful: http://volokh.com/files/BoucherDCT.1.pdf http://volokh.com/files/BoucherDCT.1.pdf and http://en.wikipedia.org/wiki/United_States_v._Boucher http://en.wikipedia.org/wiki/United_States_v._Boucher