24 ms·

Irish police to be given powers over passwords

391 points by shivbhatt 5y ago

MattIPv4 5y ago
This gives the police the power to force folks to give their passwords to the police when there is a valid search warrant issued for the electronic device. Not saying its great, but at least they have to have an actual search warrant for it first.
- xnyan 5y ago
  The law gives police the right "to seize any material found at that place or in the possession of a person present at the place" and "to request assistance from persons present so as to gain access" It sounds like anything found at the at the address of the search warrant is a valid target, and you are legally required to assist no matter the reason that you or your device was there. A search warrant is extremely powerful and should clearly spell out what it's searching for. If the police find something outside of the scope of the warrant, at very least they should be required to go back to the judge and justify why they should have access to it.
  - anfilt 5y ago
    I don't think Ireland scopes their warrants like the US. I think warrants are location based.
TrueGeek 5y ago
From the article: > "Irish police will have the power to compel people to provide passwords for electronic devices when carrying out a search warrant under new legislation." This is not unique to Ireland, we see this here in the US as well.
- kingsloi 5y ago
  I'll likely already know the answer (jail time?), but what if you were to "forget"? I have some long passwords that I keep out of password managers for private stuff that I don't want to be leaked from a password manager leak or w/e. I can remember them, but had a really hard time remembering even the start of most of them after not using them for a few weeks.
  - jagger27 5y ago
    There have been times that I’ve had to close my eyes and completely rely on muscle memory to enter a long password. Last time it happened was after a 2 week vacation. That kind of timeframe isn’t abnormal for the speed of law.
    - tediousdemise 5y ago
      Impressive! After all these years I still need to look at the keyboard.
      - jagger27 5y ago
        I find it somewhat disconcerting that my fingers remember my passwords better than my brain does!
        dkersten 5y ago
        Muscle memory still happens in the brain. A better description might be unconscious memory. I believe the proper term is "procedural memory". https://en.wikipedia.org/wiki/Procedural_memory https://en.wikipedia.org/wiki/Procedural_memory
    - spentu 5y ago
      This happens to me a lot. I need to have access to keyboard for being able to type some older password. Same thing with pin codes.. Funny how brain works.
- hwbehrens 5y ago
  > [...] we see this here in the US as well. This is only true when the revealed information is a "foregone conclusion", specifically when it "adds little or nothing to the sum total of the Government’s information." Here is a good treatment on the subject: https://harvardlawreview.org/2021/04/state-v-andrews/ https://harvardlawreview.org/2021/04/state-v-andrews/
- jhauris 5y ago
  This is something that varies state to state. Quick search shows that Pennsylvania considers giving up a password as self-incriminating testimony (protected by the 5th amendment), while Massachusetts does not. They can generally force you to use biometrics to unlock or give them a physical key anywhere, however. This seems to be an actively developing area of law around the world.
  - vmception 5y ago
    Hold power button on iphone and it disables biometric without turning off the device They might still have a way to image it though, depends on the day as the imaging software always gets thwarted
    - vmception 5y ago
      Power+volume whoops Also believe it depends on the model but the 12 pro does it like this and a few models before
  - aaron-santos 5y ago
    On the subject of the fifth amendment, there was a (possibly) non-serious theory that having one's password be the admission of guilt to a crime would serve as protection as revealing the password would actual be self-incriminating. Like most legal theories on the internet, it (probably) isn't true.
yawaworht1978 5y ago
Wow, this is very bad. Best to only ever use apps with self destroying messages and not saving images except where you want them to be seen. Warrant or not, this is going very, very far. I do not think these warrant issuing procedures will be throughout, either way, would never trust it. Which politicians are responsible for passing this into law?
- rusk 5y ago
  Heather Humphries. She is a stand in while the Minister for Justice is on maternity leave. She can get away with politically toxic stuff because she enjoys staunch support in her constituency. She’s not known for being the brightest so could not have held such a brief under normal circumstances but she is great for doing dirty jobs.
  - yawaworht1978 5y ago
    Ah yes, thought something like this. This is one of these laws, on itself it bad, but people will not realize, because they're - ironically - too busy on their phones on social media.... Nobody will go protest in the streets over this. But a couple 100 single of these shenanigans and the people will ask themselves how we ended up in this mess, and everyone will jump on the divide train and blame the "other" party, when it's really equally distributed usually. Testimony to that is that nobody opposed this hard enough to bring it down. The only bright side to this is, it appears the governments cannot easily access all things, despite five eyes and international collaboration. I find if a case is bad enough for a warrant, then maybe deploying a keylogger or similar would be the better way. At least then it's handled by a specialist. But delegating this to police officers? Hellno
    - ploika 5y ago
      Ireland isn't part of the Five Eyes though. I don't really think Helen McEntee's maternity leave is relevant either because she's in the same party as Heather Humphreys, and they are in a three-party coalition government. There's no main partisan divide like there is in the US or UK.
fitblipper 5y ago
I understand how "clever law hacks" like warrant canaries are not clever when faced against actual law enforcement practices. I say this to try to explain that the following isn't meant to be a clever trick and instead is meant as a reason why I worry about these kinds of law. I have a very long passphrase that I only have to enter at machine boot up time. After entering the pw once the password manager remains open in cache and can be opened with a much shorter and easier to remember password. Because I do not restart my phone or devices frequently I don't need to enter my password often and so my very long complicated password isn't used often. My practice has been to automatically restart my phone whenever I am approached by a police officer. This has happened maybe once in the last year or 2. If I live in Ireland, am I screwed when the stress of being detained causes me to forget my very long, complicated, and infrequently entered password?
- fragbait65 5y ago
  Yes, I honestly think you are screwed.
- jfoutz 5y ago
  Sometime during quarantine I had an evening thought excercise about clever password choices in this context. It was a fun game, and would be a cute scene in a movie or a book. Ultimately the password `fuck you cop I'll never tell` is a fun idea, but little value. Complying without appearing to comply might change up the game a bit, but you're still screwed. _edit_ it is kind of fun to think of a password so offensive that it doesn't matter who asks you, they won't believe that's your password. Technically might buy you some time before they figure it out.
  - cge 5y ago
    The way the law is worded (see my other comment), the police can force you to do whatever is necessary to unlock the device by any means at your disposal, not just disclose your password. While this would be technically a terrible idea on their part for a number of reasons, having a clever password would not be helpful.
  - dane-pgp 5y ago
choeger 5y ago
Interestingly, such a law does nothing against proper criminals. People that know they have incriminating evidence will either not carry it on their phones or uses some form of steganography to hide it perfectly. In the worst case, they will have some form of wipe-me passphrase that cleans the device before unlocking. Normal people, on the other hand, do not have these kind of (mental, time) resources. They will be forced to unlock their phones and something incriminating (for instance regarding "hate speech" or "intellectual property rights" or just "traffic violations") will be found. I consider this approach one step more in the direction of keeping every citizen an on-demand criminal. There are so many, sometimes incomprehensible, laws nowadays that pretty much everyone is not compliant.
- bennyp101 5y ago
  Can they use something they find if it's not in the scope of the warrant? (I have no idea?) But yea, your high profile criminal doing the real bad stuff is not going to be walking around with it on something that keeps a record.
  - barsonme 5y ago
    Fruit of the poisonous tree doctrine mostly doesn’t exist in Europe.
  - dkersten 5y ago
    It sounds to me that the warrants are scoped by location, not by purpose.
- pavel_lishin 5y ago
  > People that know they have incriminating evidence will either not carry it on their phones or uses some form of steganography to hide it perfectly. I think your point is valid, especially the part about normal people, but you might be overestimating the intelligence of most criminals.
- lbriner 5y ago
  "Proper criminals"? What does that even mean? There are hundreds of criminals who are not tech savvy (or not tech savvy enough) who will not have any of the mechanisms you postulate, who are frequently caught by the police and are very much "proper criminals". I don't agree with this law but to say it doesn't do anything against proper criminals is patently false.
cge 5y ago
This appears to actually go significantly beyond enforced password disclosure. From the text ( http://www.justice.ie/en/JELR/Gen_Scheme_of_AGS_(Powers)_Bill.pdf/Files/Gen_Scheme_of_AGS_(Powers)_Bill.pdf http://www.justice.ie/en/JELR/Gen_Scheme_of_AGS_(Powers)_Bil... ), on Head 16 (p 28): - An officer can use these requirements on anyone who "appears to him or her to have access". They don't appear to need any evidence beyond that. The person does not need to be a suspect or, it appears, the subject of a warrant, just a person present at the location subject to the search warrant. - It applies not just to access to information on the device, but information "which can be accessed by the use of that computer", and thus presumably includes information that is on other machine, or potentially not even in Ireland or the EU. - It allows officers to freely operate computers on site during a search (this seems like horrible forensic practice?), and use passwords found on the site to try to access any information accessible from the computer. - It does not just include disclosing passwords. It includes "any password or encryption key", and anything "to otherwise enable [the officer] to examine the information accessible by the computer". - It even appears that it allows officers to compel people not just to disclose passwords but to actually operate the device for them so as to enable information access, and "to produce the information in a form in which it can be removed". - It is not clear to me that there is any restriction on the scope of information, so long as it is in some way accessible. - Head 17 appears to allow even legally (or otherwise) privileged information to be seized, so long as "the confidentiality of the material can be maintained pending the determination by the court of the issue as to whether the material is privileged material". Combining these powers would seem to be able to result in ridiculous situations, for example, forcing a person to take data from a US server using an SSH key on their laptop, potentially violating US law by doing so, and for the person to do all the work necessary to do this themselves.
- rapht 5y ago
  I'd be interested in the reaction of all the folks who put their datacentres in Ireland (for tax or other purposes :p).
  - topranks 5y ago
    Most of them are US based, where the concept isn’t unheard of: https://imgs.xkcd.com/comics/security.png https://imgs.xkcd.com/comics/security.png
vzaliva 5y ago
Fortunately, nobody has jurisdiction over your brain. They can ask you to reveal the password but they have no way to extracit it from your head. You can always claim you forgot it.
- Err_Eek 5y ago
  Idk, there's ways of making you speak https://xkcd.com/538/ https://xkcd.com/538/
  - dane-pgp 5y ago
    If your threat model includes "The government is prepared to torture me to obtain my encryption keys", it should also include "The government is prepared to lie and claim they found incriminating evidence on my device, and lock me away forever." Just make sure that your device doesn't contain information incriminating other people who the government are trying to track down. That means not using real names, or metadata that connects pseudonyms with physical identities (e.g. phone numbers).
- staticman2 5y ago
  If the Irish legal system is like the U.S. the judge can conclude you are lying and throw you in jail for contempt of court.
  - lbriner 5y ago
    That's not quite true. The Crown would have to prove that you had either obstructed the investigation (in which case the crime would be perverting the course of justice) or you have deliberately disobeyed a court order from a previous court hearing, in which case you could be jailed but I am unaware of a judge deciding that you can be jailed just because they don't believe you. Disclaimer: UK resident who is NOT qualified in law ;-)
    - s_dev 5y ago
      >Disclaimer: UK resident who is NOT qualified in law ;-) More importantly these are the Gardai not the PSNI -- despite the source being the BBC which may have thrown you off.
bennyp101 5y ago
Ooof, what happens if you use some sort of hardware key as your password - yubikey or similar - and it ends up getting broken somehow (maybe during you being tackled to the floor or something), there would be no way to recover that password or TOTP. Simply falling over and breaking it on your keys would be enough to put you foul of this law?
- ploika 5y ago
  Presumably not, because "the key is broken" is not the same as "I refuse to hand over the keys". This law, rightly or wrongly, is concerned with the latter concept.
  - bennyp101 5y ago
    Right ok yea, that is a difference. I guess "Ah crap, it was on my keys earlier, I must have lost it - I can't do anything" would be a grey area!
    - lbriner 5y ago
      I don't think it would be a grey area. If the police couldn't prove that you were lying or had deliberately obstructed the investigation, it would be tough luck for them if you couldn't get into your own device. If you were prepared to lose your device, it would be easier to ditch it than ditch the keys but, again, not all criminals think that far ahead. I read that they caught Dread Pirate Roberts because he thought he would never get caught (in a public library!)
      - bennyp101 5y ago
        I dunno, "losing" a Yubikey Nano would be a lot easier and more believable than "losing" a laptop that you are known to carry about. In terms of plausibility, I'd favour the key being "lost" over the device. Also, if you have a backup key somewhere, you haven't lost any data or your machine.
        5y ago
BitwiseFool 5y ago
What is the deal with the governments of the British Isles being so intrusive and privacy hostile? I'm always hearing about new laws that intrude on personal privacy while also establishing an extensive surveillance capability. What is it about the cultures of that place that make the people so accepting of such government overreach?
- lbriner 5y ago
  Most people are not accepting but there is only so much power you have over an elected government. Previous suggestions have been stopped though so you can kick up a stink sometimes and have the right results. I also don't think it is that unique to the UK. It was a multi-national attack that broke EncroChat and the Australians breaking An0m (maybe with US help). Some countries love privacy at all costs like Germany and Scandinavia, some don't even assume they have privacy like Iran and China and those in the middle, like the UK, want to pretend they have privacy and are principled until they need to solve a crime and then it goes out the window!
  - ploika 5y ago
    Just for the avoidance of doubt, Ireland is not part of the UK.
- reedjosh 5y ago
  I can't really speak for them, but I keep seeing this in the US too. Individuals just don't seem to have any real recourse. These laws and systems are kafkaesque--there's just some system out there that determines the rules, and good luck finding a functioning way to push back. Also, here's one of my favorite fairly relevant quotes: > "We operate under the rule of law and are accountable for it. In some countries secret intelligence is used to control their people. In ours, it only exists to protect their freedoms." - William Hague (UK Politician) https://www.bbc.com/news/uk-politics-23053691 https://www.bbc.com/news/uk-politics-23053691
  - BitwiseFool 5y ago
    Maybe this is just my inner American, but what the Irish government is doing is tyrannical. The idea that you must render your secrets to the government just seems anathema to personal liberty. This must run afoul of some human rights commitments the UK has made, no? And, the doublespeak of the quote you mentioned is absolutely repugnant. Edit: I wrote UK government... I was mistaken and thought of Northern Ireland instead of the Republic of Ireland.
Kim_Bruning 5y ago
Ireland is currently a country that is very friendly towards large corporations, and a lot of EU data is stored in Ireland. I don't see how these rules safeguard such data; and I don't see how GDPR is complied with.
- lbriner 5y ago
  GDPR explicitly permits data to be accessed for legal purposes. I'm sure most judges would be well aware that their warrants shouldn't be overly broad but there is also a trust in legal officers to be discreet enough not to disclose anything they might have accidentally seen.
- bennyp101 5y ago
  I guess that if you have PII on your device/machine that is extra sensitive, you probably also have a decent size company behind you, in which case you could refuse until the legal team gets to you and challenges the warrant or asks for an actual forensics team to do the investigation - of course you may just give it up and let the company deal with the fallout after. If as another commentor has said, it is based on location, rather than specific devices, then I can't see a lot of these warrants holding up once it affects someone with a lot of classified stuff on there. Eg. You pop round a friends house from work, you do contracting work for the MOD and have your work laptop with you, turns out your friend is involved in some financial "bad stuff" and you happen to be there.
sys_64738 5y ago
Last time I was in Ireland, we only saw a Guarda at the airport and nowhere else. I mean, nowhere else at all. No police cars on any road and none in any towns. It was very quiet so how would they enforce this?
- PhasmaFelis 5y ago
  Just because you didn't see any police on your visit doesn't mean there are none.
- mandmandam 5y ago
  Organise a protest against being taxed a third time for water, or protest against a large fashion company pulling out with giving you your contractually obligated severance pay, and the Gardai will show up 40 strong. Landlords have gotten Gardai to assist evictions multiple times, even without cause or paperwork being shown. In contrast, a week ago or so it came out that Gardai were ignoring thousands of domestic abuse calls to emergency services - just deleting them without follow-up. I could go on and on but let there be no doubt, these are not people you would want to trust with your phone - and if you are crossing them they absolutely will show up and stand by as you get pulled around by your ears by balaclavaed thugs, etc.
prepend 5y ago
I feel like this was part of a William Gibson short story (Johnny mnemonic maybe) where data gets encrypted with a key unknown to the bearer. The key is sent through some channel unknown to the bearer. The bearer meets up with the key holders / some Dropbox location and decrypts data. The enhancement here would be some little unencrypted portion/vm so the bearer can play FarmVille in transit.
varispeed 5y ago
We need dual profiles on phones and computers - that is you can log in to the same account using different passwords and that will land you in a different environment depending on which password you used. You cannot mathematically prove that there may be a second account and thus that gives you a lot of plausible deniability.
- goddang 5y ago
  It is likely that the "clean" environment will not be used often. Therefore, it will not be very plausible.
- flenserboy 5y ago
  This makes me half-wonder whether or not concerns about this are preventing Apple from implementing multiple iOS accounts.
failwhaleshark 5y ago
"Sorry sir, I've been trying to remember it all day. I think 10 more times might do it." Fuck giving testimony against yourself.
Hamuko 5y ago
What will the EU say about this? https://www.whitecase.com/publications/alert/european-court-justice-affirms-right-silence https://www.whitecase.com/publications/alert/european-court-...
- handelaar 5y ago
  Its court will strike this down in toto as unlawful. About twelve years from now.
handelaar 5y ago
Spoiler: no they are not. EU Directive 2016/343 part 25 very clearly prohibits this kind of nonsense. Yes, the Irish state insists on pretending that EU law doesn't exist over and over and over again, but how wrong it is about that is documented by its endless appearances at the CJEU in Luxembourg and its 0% win record.
- derriz 5y ago
  Where did you get the 0% win record? Googling throws up a bunch of cases which have mixed outcomes - most recently their success in the case against the commission.
TX0098812 5y ago
It seems every time that England and its neighboring countries create any form of legislation regarding the internet, it's in an authoritarian direction. It's distasteful and gives me a bad feeling about these places. People should get on a ship somewhere and build a colony with freedom as an ideal. Something like that.
- Sebb767 5y ago
  > People should get on a ship somewhere and build a colony with freedom as an ideal Somebody tried that. Did not fare that much better [0]. [0] https://en.wikipedia.org/wiki/Mass_surveillance_in_the_United_States https://en.wikipedia.org/wiki/Mass_surveillance_in_the_Unite...
  - mdavis6890 5y ago
    I think he was talking about Seasteading: https://www.seasteading.org/ https://www.seasteading.org/ (j/k, kinda)
- young_unixer 5y ago
  > People should get on a ship somewhere and build a colony with freedom as an ideal. Something like that. https://en.wikipedia.org/wiki/Liberland https://en.wikipedia.org/wiki/Liberland
abstractbarista 5y ago
It's better to live life in prison for not giving up a password, than to be convicted of whatever they might find. (Not all will agree with this mentality, and that's fine.)
- gowld 5y ago
  Why? Isn't life in prison effectively the conviction? I could see, "better than to reveal a secret", but that's not "conviction"
  - adamauckland 5y ago
    There's different types of prison
cronix 5y ago
it would be great if phones allowed you to store 2 different passwords. One to unlock the phone as normal, and the other would actually wipe the phone. Sure, officer, my password is "deleteitall"
- anigbrowl 5y ago
  I keep seeing this suggestion, and it seems not to occur to the proponents that it would simply land someone with destruction-of-evidence charges. What I want is a system that has two passwords that unlock two wholly separate partitions, one of which is anodyne and the other which is where I keep my private opinions about Big Brother. Of course, astute investigators might wonder why the accessible partition only uses half the storage capacity of the device; you might wish to make your secret space very small and perhaps use some compression scheme as well. If you have a large amount of information that you wish to keep private, you're probably best storing it somewhere else entirely and only accessing it remotely.
  - rapht 5y ago
    > I keep seeing this suggestion, and it seems not to occur to the proponents that it would simply land someone with destruction-of-evidence charges. Only if someone can prove the data was there in the first place.
    - anigbrowl 5y ago
      I don't think so; 'evidence' takes in more than just 'what you're looking for.' If I put in my password and you get back a reset phone with no personal data whatever, then it's rather obvious that I've wiped it (eg my wallpaper picture has likely reset from my personal taste to the system default). So now you don't have the evidence to convict me of what you suspected me for, but you can bring another charge, and DoE charges will cause most people to assume that the original accusation/suspicion was well founded. If you are able to prove it by other means I'll get less sympathy from a jury and likely a much higher penalty.
  - cronix 5y ago
tomjen3 5y ago
I would love to go visit Ireland and some point, it is supposed to be a beautiful country and I am a history buff, there are so many interesting places to see. I guess it will have to wait until this law is struck down, if ever.
- boredwithlife 5y ago
  Just bring a gun. People are so ready to allow gov to get wild, but gov will start to hesitate when people begin to express displeasure. For example, your friend gets held in contempt for not providing a password. You stick it to the state by murdering one cop or gov official per day until that person's release. Of course, that relies on people giving up their lives to for the cause. But that's war.
blakebreeder 5y ago
What's to stop someone from "forgetting" their password?
kstenerud 5y ago
Here's a fun fact! If you appear to the police officer to have access or passwords, and don't give it to them, they can charge you with obstruction and jail you for up to 5 years! So if you can't prove that you don't have the password, you're in a bit of trouble! ------------------------------------- 16 (1).(e).(v) to require any person at that place who appears to him or her to have access to or to have under his power or control the information held in any such computer or which can be accessed by the use of that computer— (I) to give to him or her any password or encryption key necessary to operate it, (II) to otherwise enable him or her to examine the information accessible by the computer in a form in which the information is visible and legible, (III) to produce the information in a form in which it can be removed and in which it is, or can be made, visible and legible 67 (2).(d) A person who fails to comply with a requirement under Head 9 (1), (2) or (3), or Head 16 (1). is guilty of an offence and is liable— (i) on summary conviction, to a class A fine or imprisonment for a term not exceeding 12 months or both, or (ii) on conviction on indictment, to a fine not exceeding €30,000 or imprisonment for a term not exceeding 5 years or both
- nickthemagicman 5y ago
  So they can just throw you in jail for up to 5 years under SUSPICION. Stalin called. He wants his laws back.
  - dsr_ 5y ago
    Anyone here with reasonable knowledge of Irish jurisprudence? Is that a reasonable worry for someone who has an encrypted drive that they forgot the password for?
    - MertsA 5y ago
      >has an encrypted drive that they forgot the password for This scenario is indistinguishable from just simply having a chunk of random data in your possession. Let's say you decide to use shred to delete some file, any file. If you become the target of an investigation and they find a deleted file and the blocks haven't been overwritten since you ran shred they could claim that this file was an encrypted archive and jail you for 5 years for not being able to "unlock" it.
Black101 5y ago
That reminds me of the recent post titled "I Miss the Old Internet (2019)" ... every time they create a new law, it makes the old Internet disappear.
mdavis6890 5y ago
Relevant XKCD: https://m.xkcd.com/538/ https://m.xkcd.com/538/
- ex_amazon_sde 5y ago
  It's not.
  - mdavis6890 5y ago
    Why not? I think it's exactly relevant. Replace "hit him with this $5 wrench" with "put him in jail for contempt of court" and it amounts to the same thing. Give us your password or we will do bad things to you.
totalZero 5y ago
Cross Ireland off the list of places I want to visit. A man's phone is an extension of his mind.
- lucideer 5y ago
  Wait & see if the bill passes in parliament. After that, I may very well contemplate emigration myself (but... to where...)
Dedime 5y ago
For Irish people who wish to subvert this order, there's a handy concept in cryptography known as deniable encryption. Essentially, users (you) may convincingly deny that a plaintext version of encrypted data exists. VeraCrypt, a source-available encryption program, supports this form of encryption, such that you can create an encryption file, say 1GB. You place a password on the "outer" volume, so that when you enter the password, it mounts the encrypted volume and it appears unencrypted. However, you also put into place an "inner" hidden volume. When you enter the password for the inner volume, it mounts a separate encrypted volume. Adversaries cannot detect this inner volume, and when they twist your arm to unlock the encrypted veracrypt file, you can enter the password for the outer volume, keeping the secrets of the inner volume safe.
- tcoff91 5y ago
  so let's say the encrypted volume is 1GB. let's say there's 250MB stored in the hidden volume. Can't you reveal the existence of the hidden volume by writing data to the 'outer' volume until it is full? If you can't fit 1GB of data in the 'outer' volume doesn't that mean there must exist a hidden volume?
  - CGamesPlay 5y ago
    When mounting, you must provide the outer volume password and you may provide the inner volume password. If you mount the inner volume, you must provide the inner volume password. If you are plausibly denying the existence of the inner volume, you mount the outer volume without the inner volume password. The driver happily overwrites the "free space" where the inner volume keeps its data. It is in fact unsafe to modify the outer volume at all without providing the inner volume password (if an inner volume exists). [edit] VeraCrypt it seems only accepts the outer volume password when creating the hidden volume, but here's more about it: https://www.veracrypt.fr/en/Protection%20of%20Hidden%20Volumes.html https://www.veracrypt.fr/en/Protection%20of%20Hidden%20Volum...
- steelframe 5y ago
  Great. Now they don't know when to stop twisting your arm.
lucideer 5y ago
Whatever the likelihood of this passing, the BBC's coverage here seems poor: right now this is a Bill. It's far from being made law. Some good analyses from actual informed Irish-based perspectives here: https://twitter.com/Tupp_Ed/status/1404380471186821122 https://twitter.com/Tupp_Ed/status/1404380471186821122
- rusk 5y ago
  Thanks for this, I’ve been looking for a good run thru like this all day. There’s a lot (70 odd tweets) in that linked thread anyone looking for the summation can look here https://twitter.com/drvconway/status/1404425167699382278?s=21 https://twitter.com/drvconway/status/1404425167699382278?s=2... There is little in the analysis that gives me comfort. FG are the law and order party but paradoxically they have a history of passing poorly conceived laws presumably because they don’t feel the downsides will ever apply to them, and to provide enough legal ambiguity for those well connected to wriggle free. Ambiguity also good for the legal folk that constitute the rank and file of their membership. They are currently shored up in coalition with another establishment party (FF) and the greens so it’s conceivable that much of this could get through without challenge. Of course it’s important to remember that it is kite flying season and there is a battle for hearts and minds with the main opposition party (Sinn Féin) so it might just be a matter of whipping up their conservative base.
deleted 5y ago
[deleted]
LWIRVoltage 5y ago
Serious Question- The tech that was built to be an answer to this sort of thing ,Deniable Encryption and Plausible Deniability, exists in ...it looks like, Veracrypt, and possibly the Phone variant EDS(to a smaller extent)- But, how come there's been nothing else in the field? The only thing that appeared in the past decade to be more advanced on that front was this, https://www.bankinfosecurity.com/rise-self-concealing-steganography-a-11902 https://www.bankinfosecurity.com/rise-self-concealing-stegan... https://i.blackhat.com/eu-18/Thu-Dec-6/eu-18-Schaub-Perfectly-Deniable-Steganographic-Disk-Encryption.pdf https://i.blackhat.com/eu-18/Thu-Dec-6/eu-18-Schaub-Perfectl... https://portswigger.net/daily-swig/russian-doll-steganography-allows-users-to-mask-covert-drives https://portswigger.net/daily-swig/russian-doll-steganograph... and there's been nothing since... It must truly be hard to make fully deniable encryption mechanisms..unfortunately....
anonymousDan 5y ago
So what is being done (if anything) to push back against this? Are there any Irish civil liberties organisations kicking up a fuss?
- lucideer 5y ago
  The bill's only been very recently published (HN is picking up on this quite quickly), so there hasn't been very much official commentary on this just yet. The Irish Council for Civil Liberties are in the process of analysing it https://twitter.com/ICCLtweet/status/1404417358135971841 https://twitter.com/ICCLtweet/status/1404417358135971841 Otherwise though, there has been widespread backlash. The govt. absolutely have the votes to push this through parliament if they want to, but public sentiment could definitely give them pause. Given the scale of the bill, and it being accompanied by another related bill which apparently reduces oversight of the Garda (police), my suspicion is that this is a strategic strawman bill, with the intent being to push through a watered-down-but-still-pretty-terrible version of it after some "consultation" & amendments to remove the most publicly-objectionable highlights.
  - anonymousDan 5y ago
    Thanks. What's the underlying motive behind the push do you think? Political pressure to do something about the kinahan/hutch gangland killings? Can't see how this would be particularly effective for that but it seems to have come from nowhere no?
    - lucideer 5y ago
      Honestly I've no idea. Off the top of my head, while the severity and scope of this is indeed surprising, the direction is not. Just as police authoritarianism has been on the rise internationally (notably in the misuse of vague anti-terrorist legislation in the US & UK to grant broad policing power in many areas unrelated to terrorism), the same trend has also been present to a certain degree in Ireland. FG have been in power for 10 uninterrupted years and have traditionally been the law and order party. Their idea of police reform when the Garda was hit with numerous misconduct scandals was to install a former-RUC officer as head of the Gardaí. So this is all ideologically in line with the ruling party at least. Additionally, anti police sentiment has generally been on the increase in the past 2 years so this could be a response to that. Recently the country has been trying to open up post-covid by encouraging outdoor dining, events and gatherings (given doing so indoors is still prohibited), with many initiatives being heavily invested in by local city councils. Those initiatives have been completely undermined by riot police arriving to clear public spaces & incite street violence, seemingly with no communication or coordination with local councils (local councils typically being populated by representatives of parties who are in opposition at national gov level). So... it could be a lot of things. Or it could be gangland killings.
ww520 5y ago
How well does the I can’t remember excuse work in this case? This actually is pretty bad. Password is not just for information revealing. It’s for proof of ownership and control of the accounts. Revealing the password means ceasing control of the accounts to police.
_user112 5y ago
My friend's password is "All pigs must die"
deleted 5y ago
[deleted]
deleted 5y ago
[deleted]

391 points by shivbhatt 5y ago

This gives the police the power to force folks to give their passwords to the police when there is a valid search warrant issued for the electronic device. Not saying its great, but at least they have to have an actual search warrant for it first.

xnyan 5y ago
The law gives police the right "to seize any material found at that place or in the possession of a person present at the place" and "to request assistance from persons present so as to gain access" It sounds like anything found at the at the address of the search warrant is a valid target, and you are legally required to assist no matter the reason that you or your device was there. A search warrant is extremely powerful and should clearly spell out what it's searching for. If the police find something outside of the scope of the warrant, at very least they should be required to go back to the judge and justify why they should have access to it.
- anfilt 5y ago
  I don't think Ireland scopes their warrants like the US. I think warrants are location based.

TrueGeek 5y ago

From the article: > "Irish police will have the power to compel people to provide passwords for electronic devices when carrying out a search warrant under new legislation." This is not unique to Ireland, we see this here in the US as well.

kingsloi 5y ago
I'll likely already know the answer (jail time?), but what if you were to "forget"? I have some long passwords that I keep out of password managers for private stuff that I don't want to be leaked from a password manager leak or w/e. I can remember them, but had a really hard time remembering even the start of most of them after not using them for a few weeks.
- jagger27 5y ago
  There have been times that I’ve had to close my eyes and completely rely on muscle memory to enter a long password. Last time it happened was after a 2 week vacation. That kind of timeframe isn’t abnormal for the speed of law.
  - tediousdemise 5y ago
    Impressive! After all these years I still need to look at the keyboard.
    - jagger27 5y ago
      I find it somewhat disconcerting that my fingers remember my passwords better than my brain does!
      - dkersten 5y ago
        Muscle memory still happens in the brain. A better description might be unconscious memory. I believe the proper term is "procedural memory". https://en.wikipedia.org/wiki/Procedural_memory https://en.wikipedia.org/wiki/Procedural_memory
  - spentu 5y ago
    This happens to me a lot. I need to have access to keyboard for being able to type some older password. Same thing with pin codes.. Funny how brain works.
hwbehrens 5y ago
> [...] we see this here in the US as well. This is only true when the revealed information is a "foregone conclusion", specifically when it "adds little or nothing to the sum total of the Government’s information." Here is a good treatment on the subject: https://harvardlawreview.org/2021/04/state-v-andrews/ https://harvardlawreview.org/2021/04/state-v-andrews/
jhauris 5y ago
This is something that varies state to state. Quick search shows that Pennsylvania considers giving up a password as self-incriminating testimony (protected by the 5th amendment), while Massachusetts does not. They can generally force you to use biometrics to unlock or give them a physical key anywhere, however. This seems to be an actively developing area of law around the world.
- vmception 5y ago
  Hold power button on iphone and it disables biometric without turning off the device They might still have a way to image it though, depends on the day as the imaging software always gets thwarted
  - vmception 5y ago
    Power+volume whoops Also believe it depends on the model but the 12 pro does it like this and a few models before
- aaron-santos 5y ago
  On the subject of the fifth amendment, there was a (possibly) non-serious theory that having one's password be the admission of guilt to a crime would serve as protection as revealing the password would actual be self-incriminating. Like most legal theories on the internet, it (probably) isn't true.

yawaworht1978 5y ago

Wow, this is very bad. Best to only ever use apps with self destroying messages and not saving images except where you want them to be seen. Warrant or not, this is going very, very far. I do not think these warrant issuing procedures will be throughout, either way, would never trust it. Which politicians are responsible for passing this into law?

rusk 5y ago
Heather Humphries. She is a stand in while the Minister for Justice is on maternity leave. She can get away with politically toxic stuff because she enjoys staunch support in her constituency. She’s not known for being the brightest so could not have held such a brief under normal circumstances but she is great for doing dirty jobs.
- yawaworht1978 5y ago
  Ah yes, thought something like this. This is one of these laws, on itself it bad, but people will not realize, because they're - ironically - too busy on their phones on social media.... Nobody will go protest in the streets over this. But a couple 100 single of these shenanigans and the people will ask themselves how we ended up in this mess, and everyone will jump on the divide train and blame the "other" party, when it's really equally distributed usually. Testimony to that is that nobody opposed this hard enough to bring it down. The only bright side to this is, it appears the governments cannot easily access all things, despite five eyes and international collaboration. I find if a case is bad enough for a warrant, then maybe deploying a keylogger or similar would be the better way. At least then it's handled by a specialist. But delegating this to police officers? Hellno
  - ploika 5y ago
    Ireland isn't part of the Five Eyes though. I don't really think Helen McEntee's maternity leave is relevant either because she's in the same party as Heather Humphreys, and they are in a three-party coalition government. There's no main partisan divide like there is in the US or UK.

fitblipper 5y ago

I understand how "clever law hacks" like warrant canaries are not clever when faced against actual law enforcement practices. I say this to try to explain that the following isn't meant to be a clever trick and instead is meant as a reason why I worry about these kinds of law. I have a very long passphrase that I only have to enter at machine boot up time. After entering the pw once the password manager remains open in cache and can be opened with a much shorter and easier to remember password. Because I do not restart my phone or devices frequently I don't need to enter my password often and so my very long complicated password isn't used often. My practice has been to automatically restart my phone whenever I am approached by a police officer. This has happened maybe once in the last year or 2. If I live in Ireland, am I screwed when the stress of being detained causes me to forget my very long, complicated, and infrequently entered password?

fragbait65 5y ago
Yes, I honestly think you are screwed.
jfoutz 5y ago
Sometime during quarantine I had an evening thought excercise about clever password choices in this context. It was a fun game, and would be a cute scene in a movie or a book. Ultimately the password `fuck you cop I'll never tell` is a fun idea, but little value. Complying without appearing to comply might change up the game a bit, but you're still screwed. _edit_ it is kind of fun to think of a password so offensive that it doesn't matter who asks you, they won't believe that's your password. Technically might buy you some time before they figure it out.
- cge 5y ago
  The way the law is worded (see my other comment), the police can force you to do whatever is necessary to unlock the device by any means at your disposal, not just disclose your password. While this would be technically a terrible idea on their part for a number of reasons, having a clever password would not be helpful.
- dane-pgp 5y ago

choeger 5y ago

Interestingly, such a law does nothing against proper criminals. People that know they have incriminating evidence will either not carry it on their phones or uses some form of steganography to hide it perfectly. In the worst case, they will have some form of wipe-me passphrase that cleans the device before unlocking. Normal people, on the other hand, do not have these kind of (mental, time) resources. They will be forced to unlock their phones and something incriminating (for instance regarding "hate speech" or "intellectual property rights" or just "traffic violations") will be found. I consider this approach one step more in the direction of keeping every citizen an on-demand criminal. There are so many, sometimes incomprehensible, laws nowadays that pretty much everyone is not compliant.

bennyp101 5y ago
Can they use something they find if it's not in the scope of the warrant? (I have no idea?) But yea, your high profile criminal doing the real bad stuff is not going to be walking around with it on something that keeps a record.
- barsonme 5y ago
  Fruit of the poisonous tree doctrine mostly doesn’t exist in Europe.
- dkersten 5y ago
  It sounds to me that the warrants are scoped by location, not by purpose.
pavel_lishin 5y ago
> People that know they have incriminating evidence will either not carry it on their phones or uses some form of steganography to hide it perfectly. I think your point is valid, especially the part about normal people, but you might be overestimating the intelligence of most criminals.
lbriner 5y ago
"Proper criminals"? What does that even mean? There are hundreds of criminals who are not tech savvy (or not tech savvy enough) who will not have any of the mechanisms you postulate, who are frequently caught by the police and are very much "proper criminals". I don't agree with this law but to say it doesn't do anything against proper criminals is patently false.

cge 5y ago

This appears to actually go significantly beyond enforced password disclosure. From the text ( http://www.justice.ie/en/JELR/Gen_Scheme_of_AGS_(Powers)_Bill.pdf/Files/Gen_Scheme_of_AGS_(Powers)_Bill.pdf http://www.justice.ie/en/JELR/Gen_Scheme_of_AGS_(Powers)_Bil... ), on Head 16 (p 28): - An officer can use these requirements on anyone who "appears to him or her to have access". They don't appear to need any evidence beyond that. The person does not need to be a suspect or, it appears, the subject of a warrant, just a person present at the location subject to the search warrant. - It applies not just to access to information on the device, but information "which can be accessed by the use of that computer", and thus presumably includes information that is on other machine, or potentially not even in Ireland or the EU. - It allows officers to freely operate computers on site during a search (this seems like horrible forensic practice?), and use passwords found on the site to try to access any information accessible from the computer. - It does not just include disclosing passwords. It includes "any password or encryption key", and anything "to otherwise enable [the officer] to examine the information accessible by the computer". - It even appears that it allows officers to compel people not just to disclose passwords but to actually operate the device for them so as to enable information access, and "to produce the information in a form in which it can be removed". - It is not clear to me that there is any restriction on the scope of information, so long as it is in some way accessible. - Head 17 appears to allow even legally (or otherwise) privileged information to be seized, so long as "the confidentiality of the material can be maintained pending the determination by the court of the issue as to whether the material is privileged material". Combining these powers would seem to be able to result in ridiculous situations, for example, forcing a person to take data from a US server using an SSH key on their laptop, potentially violating US law by doing so, and for the person to do all the work necessary to do this themselves.

rapht 5y ago
I'd be interested in the reaction of all the folks who put their datacentres in Ireland (for tax or other purposes :p).
- topranks 5y ago
  Most of them are US based, where the concept isn’t unheard of: https://imgs.xkcd.com/comics/security.png https://imgs.xkcd.com/comics/security.png

vzaliva 5y ago

Fortunately, nobody has jurisdiction over your brain. They can ask you to reveal the password but they have no way to extracit it from your head. You can always claim you forgot it.

Err_Eek 5y ago
Idk, there's ways of making you speak https://xkcd.com/538/ https://xkcd.com/538/
- dane-pgp 5y ago
  If your threat model includes "The government is prepared to torture me to obtain my encryption keys", it should also include "The government is prepared to lie and claim they found incriminating evidence on my device, and lock me away forever." Just make sure that your device doesn't contain information incriminating other people who the government are trying to track down. That means not using real names, or metadata that connects pseudonyms with physical identities (e.g. phone numbers).
staticman2 5y ago
If the Irish legal system is like the U.S. the judge can conclude you are lying and throw you in jail for contempt of court.
- lbriner 5y ago
  That's not quite true. The Crown would have to prove that you had either obstructed the investigation (in which case the crime would be perverting the course of justice) or you have deliberately disobeyed a court order from a previous court hearing, in which case you could be jailed but I am unaware of a judge deciding that you can be jailed just because they don't believe you. Disclaimer: UK resident who is NOT qualified in law ;-)
  - s_dev 5y ago
    >Disclaimer: UK resident who is NOT qualified in law ;-) More importantly these are the Gardai not the PSNI -- despite the source being the BBC which may have thrown you off.

bennyp101 5y ago

Ooof, what happens if you use some sort of hardware key as your password - yubikey or similar - and it ends up getting broken somehow (maybe during you being tackled to the floor or something), there would be no way to recover that password or TOTP. Simply falling over and breaking it on your keys would be enough to put you foul of this law?

ploika 5y ago
Presumably not, because "the key is broken" is not the same as "I refuse to hand over the keys". This law, rightly or wrongly, is concerned with the latter concept.
- bennyp101 5y ago
  Right ok yea, that is a difference. I guess "Ah crap, it was on my keys earlier, I must have lost it - I can't do anything" would be a grey area!
  - lbriner 5y ago
    I don't think it would be a grey area. If the police couldn't prove that you were lying or had deliberately obstructed the investigation, it would be tough luck for them if you couldn't get into your own device. If you were prepared to lose your device, it would be easier to ditch it than ditch the keys but, again, not all criminals think that far ahead. I read that they caught Dread Pirate Roberts because he thought he would never get caught (in a public library!)
    - bennyp101 5y ago
      I dunno, "losing" a Yubikey Nano would be a lot easier and more believable than "losing" a laptop that you are known to carry about. In terms of plausibility, I'd favour the key being "lost" over the device. Also, if you have a backup key somewhere, you haven't lost any data or your machine.
      - 5y ago

BitwiseFool 5y ago

What is the deal with the governments of the British Isles being so intrusive and privacy hostile? I'm always hearing about new laws that intrude on personal privacy while also establishing an extensive surveillance capability. What is it about the cultures of that place that make the people so accepting of such government overreach?

lbriner 5y ago
Most people are not accepting but there is only so much power you have over an elected government. Previous suggestions have been stopped though so you can kick up a stink sometimes and have the right results. I also don't think it is that unique to the UK. It was a multi-national attack that broke EncroChat and the Australians breaking An0m (maybe with US help). Some countries love privacy at all costs like Germany and Scandinavia, some don't even assume they have privacy like Iran and China and those in the middle, like the UK, want to pretend they have privacy and are principled until they need to solve a crime and then it goes out the window!
- ploika 5y ago
  Just for the avoidance of doubt, Ireland is not part of the UK.
reedjosh 5y ago
I can't really speak for them, but I keep seeing this in the US too. Individuals just don't seem to have any real recourse. These laws and systems are kafkaesque--there's just some system out there that determines the rules, and good luck finding a functioning way to push back. Also, here's one of my favorite fairly relevant quotes: > "We operate under the rule of law and are accountable for it. In some countries secret intelligence is used to control their people. In ours, it only exists to protect their freedoms." - William Hague (UK Politician) https://www.bbc.com/news/uk-politics-23053691 https://www.bbc.com/news/uk-politics-23053691
- BitwiseFool 5y ago
  Maybe this is just my inner American, but what the Irish government is doing is tyrannical. The idea that you must render your secrets to the government just seems anathema to personal liberty. This must run afoul of some human rights commitments the UK has made, no? And, the doublespeak of the quote you mentioned is absolutely repugnant. Edit: I wrote UK government... I was mistaken and thought of Northern Ireland instead of the Republic of Ireland.

Kim_Bruning 5y ago

Ireland is currently a country that is very friendly towards large corporations, and a lot of EU data is stored in Ireland. I don't see how these rules safeguard such data; and I don't see how GDPR is complied with.

lbriner 5y ago
GDPR explicitly permits data to be accessed for legal purposes. I'm sure most judges would be well aware that their warrants shouldn't be overly broad but there is also a trust in legal officers to be discreet enough not to disclose anything they might have accidentally seen.
bennyp101 5y ago
I guess that if you have PII on your device/machine that is extra sensitive, you probably also have a decent size company behind you, in which case you could refuse until the legal team gets to you and challenges the warrant or asks for an actual forensics team to do the investigation - of course you may just give it up and let the company deal with the fallout after. If as another commentor has said, it is based on location, rather than specific devices, then I can't see a lot of these warrants holding up once it affects someone with a lot of classified stuff on there. Eg. You pop round a friends house from work, you do contracting work for the MOD and have your work laptop with you, turns out your friend is involved in some financial "bad stuff" and you happen to be there.

sys_64738 5y ago

Last time I was in Ireland, we only saw a Guarda at the airport and nowhere else. I mean, nowhere else at all. No police cars on any road and none in any towns. It was very quiet so how would they enforce this?

PhasmaFelis 5y ago
Just because you didn't see any police on your visit doesn't mean there are none.
mandmandam 5y ago
Organise a protest against being taxed a third time for water, or protest against a large fashion company pulling out with giving you your contractually obligated severance pay, and the Gardai will show up 40 strong. Landlords have gotten Gardai to assist evictions multiple times, even without cause or paperwork being shown. In contrast, a week ago or so it came out that Gardai were ignoring thousands of domestic abuse calls to emergency services - just deleting them without follow-up. I could go on and on but let there be no doubt, these are not people you would want to trust with your phone - and if you are crossing them they absolutely will show up and stand by as you get pulled around by your ears by balaclavaed thugs, etc.

prepend 5y ago

I feel like this was part of a William Gibson short story (Johnny mnemonic maybe) where data gets encrypted with a key unknown to the bearer. The key is sent through some channel unknown to the bearer. The bearer meets up with the key holders / some Dropbox location and decrypts data. The enhancement here would be some little unencrypted portion/vm so the bearer can play FarmVille in transit.

varispeed 5y ago

We need dual profiles on phones and computers - that is you can log in to the same account using different passwords and that will land you in a different environment depending on which password you used. You cannot mathematically prove that there may be a second account and thus that gives you a lot of plausible deniability.

goddang 5y ago
It is likely that the "clean" environment will not be used often. Therefore, it will not be very plausible.
flenserboy 5y ago
This makes me half-wonder whether or not concerns about this are preventing Apple from implementing multiple iOS accounts.

failwhaleshark 5y ago

"Sorry sir, I've been trying to remember it all day. I think 10 more times might do it." Fuck giving testimony against yourself.

Hamuko 5y ago

What will the EU say about this? https://www.whitecase.com/publications/alert/european-court-justice-affirms-right-silence https://www.whitecase.com/publications/alert/european-court-...

handelaar 5y ago
Its court will strike this down in toto as unlawful. About twelve years from now.

handelaar 5y ago

Spoiler: no they are not. EU Directive 2016/343 part 25 very clearly prohibits this kind of nonsense. Yes, the Irish state insists on pretending that EU law doesn't exist over and over and over again, but how wrong it is about that is documented by its endless appearances at the CJEU in Luxembourg and its 0% win record.

derriz 5y ago
Where did you get the 0% win record? Googling throws up a bunch of cases which have mixed outcomes - most recently their success in the case against the commission.

TX0098812 5y ago

It seems every time that England and its neighboring countries create any form of legislation regarding the internet, it's in an authoritarian direction. It's distasteful and gives me a bad feeling about these places. People should get on a ship somewhere and build a colony with freedom as an ideal. Something like that.

Sebb767 5y ago
> People should get on a ship somewhere and build a colony with freedom as an ideal Somebody tried that. Did not fare that much better [0]. [0] https://en.wikipedia.org/wiki/Mass_surveillance_in_the_United_States https://en.wikipedia.org/wiki/Mass_surveillance_in_the_Unite...
- mdavis6890 5y ago
  I think he was talking about Seasteading: https://www.seasteading.org/ https://www.seasteading.org/ (j/k, kinda)
young_unixer 5y ago
> People should get on a ship somewhere and build a colony with freedom as an ideal. Something like that. https://en.wikipedia.org/wiki/Liberland https://en.wikipedia.org/wiki/Liberland

abstractbarista 5y ago

It's better to live life in prison for not giving up a password, than to be convicted of whatever they might find. (Not all will agree with this mentality, and that's fine.)

gowld 5y ago
Why? Isn't life in prison effectively the conviction? I could see, "better than to reveal a secret", but that's not "conviction"
- adamauckland 5y ago
  There's different types of prison

cronix 5y ago

it would be great if phones allowed you to store 2 different passwords. One to unlock the phone as normal, and the other would actually wipe the phone. Sure, officer, my password is "deleteitall"

anigbrowl 5y ago
I keep seeing this suggestion, and it seems not to occur to the proponents that it would simply land someone with destruction-of-evidence charges. What I want is a system that has two passwords that unlock two wholly separate partitions, one of which is anodyne and the other which is where I keep my private opinions about Big Brother. Of course, astute investigators might wonder why the accessible partition only uses half the storage capacity of the device; you might wish to make your secret space very small and perhaps use some compression scheme as well. If you have a large amount of information that you wish to keep private, you're probably best storing it somewhere else entirely and only accessing it remotely.
- rapht 5y ago
  > I keep seeing this suggestion, and it seems not to occur to the proponents that it would simply land someone with destruction-of-evidence charges. Only if someone can prove the data was there in the first place.
  - anigbrowl 5y ago
    I don't think so; 'evidence' takes in more than just 'what you're looking for.' If I put in my password and you get back a reset phone with no personal data whatever, then it's rather obvious that I've wiped it (eg my wallpaper picture has likely reset from my personal taste to the system default). So now you don't have the evidence to convict me of what you suspected me for, but you can bring another charge, and DoE charges will cause most people to assume that the original accusation/suspicion was well founded. If you are able to prove it by other means I'll get less sympathy from a jury and likely a much higher penalty.
- cronix 5y ago

tomjen3 5y ago

I would love to go visit Ireland and some point, it is supposed to be a beautiful country and I am a history buff, there are so many interesting places to see. I guess it will have to wait until this law is struck down, if ever.

boredwithlife 5y ago
Just bring a gun. People are so ready to allow gov to get wild, but gov will start to hesitate when people begin to express displeasure. For example, your friend gets held in contempt for not providing a password. You stick it to the state by murdering one cop or gov official per day until that person's release. Of course, that relies on people giving up their lives to for the cause. But that's war.

blakebreeder 5y ago

What's to stop someone from "forgetting" their password?

kstenerud 5y ago

Here's a fun fact! If you appear to the police officer to have access or passwords, and don't give it to them, they can charge you with obstruction and jail you for up to 5 years! So if you can't prove that you don't have the password, you're in a bit of trouble! ------------------------------------- 16 (1).(e).(v) to require any person at that place who appears to him or her to have access to or to have under his power or control the information held in any such computer or which can be accessed by the use of that computer— (I) to give to him or her any password or encryption key necessary to operate it, (II) to otherwise enable him or her to examine the information accessible by the computer in a form in which the information is visible and legible, (III) to produce the information in a form in which it can be removed and in which it is, or can be made, visible and legible 67 (2).(d) A person who fails to comply with a requirement under Head 9 (1), (2) or (3), or Head 16 (1). is guilty of an offence and is liable— (i) on summary conviction, to a class A fine or imprisonment for a term not exceeding 12 months or both, or (ii) on conviction on indictment, to a fine not exceeding €30,000 or imprisonment for a term not exceeding 5 years or both

nickthemagicman 5y ago
So they can just throw you in jail for up to 5 years under SUSPICION. Stalin called. He wants his laws back.
- dsr_ 5y ago
  Anyone here with reasonable knowledge of Irish jurisprudence? Is that a reasonable worry for someone who has an encrypted drive that they forgot the password for?
  - MertsA 5y ago
    >has an encrypted drive that they forgot the password for This scenario is indistinguishable from just simply having a chunk of random data in your possession. Let's say you decide to use shred to delete some file, any file. If you become the target of an investigation and they find a deleted file and the blocks haven't been overwritten since you ran shred they could claim that this file was an encrypted archive and jail you for 5 years for not being able to "unlock" it.

Black101 5y ago

That reminds me of the recent post titled "I Miss the Old Internet (2019)" ... every time they create a new law, it makes the old Internet disappear.

mdavis6890 5y ago

Relevant XKCD: https://m.xkcd.com/538/ https://m.xkcd.com/538/

ex_amazon_sde 5y ago
It's not.
- mdavis6890 5y ago
  Why not? I think it's exactly relevant. Replace "hit him with this $5 wrench" with "put him in jail for contempt of court" and it amounts to the same thing. Give us your password or we will do bad things to you.

totalZero 5y ago

Cross Ireland off the list of places I want to visit. A man's phone is an extension of his mind.

lucideer 5y ago
Wait & see if the bill passes in parliament. After that, I may very well contemplate emigration myself (but... to where...)

Dedime 5y ago

For Irish people who wish to subvert this order, there's a handy concept in cryptography known as deniable encryption. Essentially, users (you) may convincingly deny that a plaintext version of encrypted data exists. VeraCrypt, a source-available encryption program, supports this form of encryption, such that you can create an encryption file, say 1GB. You place a password on the "outer" volume, so that when you enter the password, it mounts the encrypted volume and it appears unencrypted. However, you also put into place an "inner" hidden volume. When you enter the password for the inner volume, it mounts a separate encrypted volume. Adversaries cannot detect this inner volume, and when they twist your arm to unlock the encrypted veracrypt file, you can enter the password for the outer volume, keeping the secrets of the inner volume safe.

tcoff91 5y ago
so let's say the encrypted volume is 1GB. let's say there's 250MB stored in the hidden volume. Can't you reveal the existence of the hidden volume by writing data to the 'outer' volume until it is full? If you can't fit 1GB of data in the 'outer' volume doesn't that mean there must exist a hidden volume?
- CGamesPlay 5y ago
  When mounting, you must provide the outer volume password and you may provide the inner volume password. If you mount the inner volume, you must provide the inner volume password. If you are plausibly denying the existence of the inner volume, you mount the outer volume without the inner volume password. The driver happily overwrites the "free space" where the inner volume keeps its data. It is in fact unsafe to modify the outer volume at all without providing the inner volume password (if an inner volume exists). [edit] VeraCrypt it seems only accepts the outer volume password when creating the hidden volume, but here's more about it: https://www.veracrypt.fr/en/Protection%20of%20Hidden%20Volumes.html https://www.veracrypt.fr/en/Protection%20of%20Hidden%20Volum...
steelframe 5y ago
Great. Now they don't know when to stop twisting your arm.

lucideer 5y ago

Whatever the likelihood of this passing, the BBC's coverage here seems poor: right now this is a Bill. It's far from being made law. Some good analyses from actual informed Irish-based perspectives here: https://twitter.com/Tupp_Ed/status/1404380471186821122 https://twitter.com/Tupp_Ed/status/1404380471186821122

rusk 5y ago
Thanks for this, I’ve been looking for a good run thru like this all day. There’s a lot (70 odd tweets) in that linked thread anyone looking for the summation can look here https://twitter.com/drvconway/status/1404425167699382278?s=21 https://twitter.com/drvconway/status/1404425167699382278?s=2... There is little in the analysis that gives me comfort. FG are the law and order party but paradoxically they have a history of passing poorly conceived laws presumably because they don’t feel the downsides will ever apply to them, and to provide enough legal ambiguity for those well connected to wriggle free. Ambiguity also good for the legal folk that constitute the rank and file of their membership. They are currently shored up in coalition with another establishment party (FF) and the greens so it’s conceivable that much of this could get through without challenge. Of course it’s important to remember that it is kite flying season and there is a battle for hearts and minds with the main opposition party (Sinn Féin) so it might just be a matter of whipping up their conservative base.

deleted 5y ago

[deleted]

LWIRVoltage 5y ago

Serious Question- The tech that was built to be an answer to this sort of thing ,Deniable Encryption and Plausible Deniability, exists in ...it looks like, Veracrypt, and possibly the Phone variant EDS(to a smaller extent)- But, how come there's been nothing else in the field? The only thing that appeared in the past decade to be more advanced on that front was this, https://www.bankinfosecurity.com/rise-self-concealing-steganography-a-11902 https://www.bankinfosecurity.com/rise-self-concealing-stegan... https://i.blackhat.com/eu-18/Thu-Dec-6/eu-18-Schaub-Perfectly-Deniable-Steganographic-Disk-Encryption.pdf https://i.blackhat.com/eu-18/Thu-Dec-6/eu-18-Schaub-Perfectl... https://portswigger.net/daily-swig/russian-doll-steganography-allows-users-to-mask-covert-drives https://portswigger.net/daily-swig/russian-doll-steganograph... and there's been nothing since... It must truly be hard to make fully deniable encryption mechanisms..unfortunately....

anonymousDan 5y ago

So what is being done (if anything) to push back against this? Are there any Irish civil liberties organisations kicking up a fuss?

lucideer 5y ago
The bill's only been very recently published (HN is picking up on this quite quickly), so there hasn't been very much official commentary on this just yet. The Irish Council for Civil Liberties are in the process of analysing it https://twitter.com/ICCLtweet/status/1404417358135971841 https://twitter.com/ICCLtweet/status/1404417358135971841 Otherwise though, there has been widespread backlash. The govt. absolutely have the votes to push this through parliament if they want to, but public sentiment could definitely give them pause. Given the scale of the bill, and it being accompanied by another related bill which apparently reduces oversight of the Garda (police), my suspicion is that this is a strategic strawman bill, with the intent being to push through a watered-down-but-still-pretty-terrible version of it after some "consultation" & amendments to remove the most publicly-objectionable highlights.
- anonymousDan 5y ago
  Thanks. What's the underlying motive behind the push do you think? Political pressure to do something about the kinahan/hutch gangland killings? Can't see how this would be particularly effective for that but it seems to have come from nowhere no?
  - lucideer 5y ago
    Honestly I've no idea. Off the top of my head, while the severity and scope of this is indeed surprising, the direction is not. Just as police authoritarianism has been on the rise internationally (notably in the misuse of vague anti-terrorist legislation in the US & UK to grant broad policing power in many areas unrelated to terrorism), the same trend has also been present to a certain degree in Ireland. FG have been in power for 10 uninterrupted years and have traditionally been the law and order party. Their idea of police reform when the Garda was hit with numerous misconduct scandals was to install a former-RUC officer as head of the Gardaí. So this is all ideologically in line with the ruling party at least. Additionally, anti police sentiment has generally been on the increase in the past 2 years so this could be a response to that. Recently the country has been trying to open up post-covid by encouraging outdoor dining, events and gatherings (given doing so indoors is still prohibited), with many initiatives being heavily invested in by local city councils. Those initiatives have been completely undermined by riot police arriving to clear public spaces & incite street violence, seemingly with no communication or coordination with local councils (local councils typically being populated by representatives of parties who are in opposition at national gov level). So... it could be a lot of things. Or it could be gangland killings.

ww520 5y ago

How well does the I can’t remember excuse work in this case? This actually is pretty bad. Password is not just for information revealing. It’s for proof of ownership and control of the accounts. Revealing the password means ceasing control of the accounts to police.

_user112 5y ago

My friend's password is "All pigs must die"

deleted 5y ago

[deleted]

deleted 5y ago

[deleted]