4 ms·

The truly interesting bit, will be when a case of (real or alleged) multiple hidden encrypted volumes is publicized. If the government feels the information th

• DavidSJ 15y ago
  US v Hubbell makes clear that the government cannot compel production of documents (except under immunity to prosecution) which it does not know, ahead of time, to exist.
  • roc 15y ago
    Then how can they compel someone to unlock a laptop to enable arbitrary access? Wouldn't they be limited to requesting specific documents?
    • sorbus 15y ago
      The legal system allows them to do things analogous to that, such as compelling someone to open a safe to enable arbitrary access to the contents (as mentioned in the article). Presumably they must suspect that the safe contains documents relevant to the case.
    • bhousel 15y ago
      Every case is a little different, but investigators do need probable cause to search a laptop. This is a mortgage fraud case involving years of criminal activity, so I'm guessing that it's probably not too hard for the prosecution to produce witnesses who can say "yes, she sold me that crappy mortgage and used her laptop when I went to meet with her.", or direct information of her internet usage (ISP, or logs from cable modem), or observation of her using the laptop by police during the investigation.
      • palish 15y ago
        So the moral of the story is, conduct your criminal activity via software running on an external server on a TrueCrypt partiton, and always interface with it via Tor? Then they can't prove it's "your server" and thus order you to reveal the key. (For example, if you have access to a credit card not in your name, you can set up an EC2 micro instance for free for a year. Then install TeueCrypt and be on your merry criminal way. What could the DOJ do?)
        • marshray 15y ago
          The DoJ would simply get a judge to sign an order giving their forensics lab a snapshot of the virtual machine with the key sitting decrypted in RAM. Amazon would be under a gag order not to tell you that they even had it (not that Amazon would even care to tell you anyway). If they wanted to pin it to you, they could easily show timing correlations between your client system activity and the VM activity. Probably they would also go to the person who lent you their credit card and threaten them with prosecution unless they fingered you. Cryptography is not going to save you from prosecution if you do any noteworthy crime. There is no security "in the cloud" from any government with a jurisdictional or financial relationship with the provider. (Though Tahoe LAFS is an interesting project).
          • palish 15y ago
            Interesting. Good point.
          • deleted 15y ago
            [deleted]
      • VladRussian 15y ago
        the DOJ have laptop (like a knife in a murder case). According to Miranda, the defendant have the right to remain silent (incl. all kinds of communications, ie. oral, keyboard typing, Morse alphabet using campfire smoke, etc... ) and, in particular, can't be compelled into communicating any information in connection with her/his using of the laptop (or murder knife), while the DOJ is free to have as much witnesses as they can describing defendant's usage of the alleged crime tool.
  • llambda 15y ago
    So what if the govt suggests a document exists (claims to know exists) and therefore could be located on an encrypted volume is that grounds for them to force someone to decrypt that volume or be held in contempt of court?
• kenjackson 15y ago
  If the government feels the information they want is on a laptop, the laptop's owner would suddenly find themselves forced to prove a negative (there are no more hidden volumes), lest they be held in contempt. I think it will still be a requirement for the gov't to show that there's cause. In the same way that the gov't can't hold you if they suspect you know where a kidnapped victim is held, unless they have evidence that you do know where they're at (it's similar in that you don't have to prove a negative, rather the police must show that there's reason to hold you). So they must have evidence that suggests there is another volume.
  • roc 15y ago
    Suppose someone uses my wifi connection to hack into, say, a Sony server and retrieve a database of credit card information. The government would have evidence and reason to believe I have that data. So, naturally, they'll get to seize my laptop and apparently can compel me to unlock it and allow them arbitrary access. It seems to me that they don't know the stolen data resides on that laptop any more than they know whether I have a hidden volume that contains the data they're searching for. So if their evidence is good enough to compel me to produce a password, why would it not be good enough to insist a hidden volume contains the data and that I'm withholding the sought-after data? If someone can simply say "nope, no hidden volumes here" and that's the end of it, it would be trivial to defeat a digital investigation. In short, I'm skeptical about what defines the reasonableness of an investigation and this apparent power to compel arbitrary access to documents.
    • SoftwareMaven 15y ago
      I think that's where forensics would come in: "This is a 2TB drive. All the data on the drive amounts to 1.5TB. QED, there is 500GB of data missing." More interesting, IMO, would be how alleged steganography would be handled.
      • burgerbrain 15y ago
        Thankfully that is not how truecrypt works. The volume would be reported as the full 2TB (or however large the container is), it is up to you to not use all the space (which you could do, it will just silently start overwriting the hidden volume. They would have nothing to go on other than you didn't fill the disk (who does?).
• gospelwut 15y ago
  For her sake, she has a hidden & real TC volumes -- i.e. she has both a real and fake TC OS volume. I don't know of any other encryption methods that allow hiding a volume within another volume as such. Even so, if I boot up your fake volume and it's pretty apparent it hasn't been used in 8-months or simply has a blank My Docs folder, I don't know how that will go. I suppose somebody could make the argument that all that unused space is slack or something like that ("Oh yeah I only use 20GB/200GB HDD). Though, as people have said, this is pretty new territory. Perhaps I misread the article, but I didn't see a mention of whether this involved hidden TC volumes or not. EDIT: Clarity.
  • sorbus 15y ago
    The standard method is to use one operating system in normal, day-to-day operations and another (in a hidden volume) whenever you're doing something sensitive or potentially illegal (you would also change the MAC address, not use it on your own wifi network, and so forth). However, it's probably too much to hope that most people actually realize this, especially criminals. Extremely paranoid people will have absolutely nothing incriminating on the computer, leave it unencrypted (to avoid suspicion), and use disposable flash drives with a small Linux image on them whenever they want to do something illegal. The flash drives are destroyed after one use. Oh, and anyone smart enough to do that wouldn't describe their method on a public forum. Also, your first sentence really irritates me: having the entire OS volume encrypted in no way means that you have two OS volumes, which you seem to be saying.
    • gospelwut 15y ago
      I didn't mean to imply that, I meant to imply one "should" have two different volumes with different operating systems as to ensure no artifices from your misdeeds are on the "day to day" volume (assuming said criminal is using Windows). I'm merely going off my understanding of the ideal TC setup, as I don't bother having one setup in such a manner. I am of the opinion, as you stated, most criminals are not wise enough to go through the extra steps necessary to truly make TC hidden volumes reliable. From my experience, the extent of most peoples' tech savvy is running CCleaner or in the RAREST of cases Eraser. Though, I should say my experiences are 90% corporate.