4 ms·

> So they can get a warrant to come into your house while you're not home and put a keylogger in your keyboard USB cable, or put a bug on the UART of your route

> So they can get a warrant to come into your house while you're not home and put a keylogger in your keyboard USB cable, or put a bug on the UART of your router, etc. Or just hacking your cheap Netgear router with one of the hundreds of vulnerabilities that exist. That's actually not that weird. If you are a suspected criminal and a judge give a warrant targeting you specifically, it's quite natural the police can now gather information on you by any mean possible. It's not warrant-less, it's not mass surveillance, it sounds like regular police work. Or am I missing something?

ben_w 5y ago
Not being a legal expert, I can’t tell where the boundary is between enabling legitimate police work and giving (accidentally or deliberately) the police the power to plant fake evidence, the latter being what some of this sounds like. But, I’m not a legal expert, and “sounds like” is a way to make very large mistakes when looking outside of one’s own domain of expertise like I’m doing here. (Also doesn’t help that I hear about stories like this from people who don’t like them, so I get a potentially biased first impression).
- BiteCode_dev 5y ago
  They could always do that: once they have a warrant, they can search your house and pretend to find physical evidences in it.
  - ben_w 5y ago
    Indeed they could. However the linked page says: > A DATA DISRUPTION WARRANT enables the agencies to “add, copy, delete or alter” data on devices. With the exception of the word “copy”, this makes it seem like the plan is to make it not merely possible but also legally acceptable for anyone given such a warrant to create/place that evidence (or delete things to make real data look incriminating by lack of context). Again, I really know I can’t trust my interpretation of any legal text, all I can say is it does sound bad to an outsider like me.
- nonameiguess 5y ago
  I have no idea how Australia handles this, but in the U.S., the process of discovery is what is supposed to keep the police from just planting evidence. Prosecution needs to present all evidence that will be used against you, including exactly where it came from and chain of custody. If they can't, it gets thrown out. The only exception is they can't be compelled to give away the identity of confidential informants. But a confidential informant also can't testify anonymously, so the police would always need additional evidence beyond the word of a CI. It's not a perfect system by any means. The police can and do plant evidence. But a lot of convictions also get thrown out and this is often why obviously guilty people get off on "technicalities" because the police don't follow procedure down to the letter. The opposite end of the spectrum, not giving the police any power to do covert surveillance at all, is effectively just giving a license to the Mafia to do whatever it wants, as anyone who just commits all of their crimes privately will get away with it as long as they can sufficiently scare or kill anyone who would otherwise have been willing to testify. It's a tradeoff either way, and we try to let there be a middle ground, where the police can bug your house, tap your phone, hack your router, but they need a warrant that has to be granted by a completely separate branch of government that is not in the same chain of command, and they have to prove to your lawyers that they obtained all of the evidence they have against you legally.
  - ben_w 5y ago
    Indeed, I have no issue with the police having the power to read whatever data a warrant grants. My problem is the linked page says: > A DATA DISRUPTION WARRANT enables the agencies to “add, copy, delete or alter” data on devices. Copy is fine, it’s the other three which are scary. Perhaps they shouldn’t be scary, perhaps they have well-defined meanings in law I’m just not familiar with (like how “Hacker News” has nothing to do with cyber crime), but I can only respond within the limits of my knowledge, and that seems scary.
    - aljp 5y ago
      I think the reason they want the ability to add, delete, and alter is so they can disrupt certain users, software, or services legally, like botnets or arms deals. It's probably too broad and could be abused though.
matheusmoreira 5y ago
It's certainly better than simply compromising everyone but it's not like they're going to stop their mass surveillance activities. This is just a step towards legitimization of those activities. It's time for computer security to include nation states in their threat model. We need tamper-evident hardware.

ben_w 5y ago

Not being a legal expert, I can’t tell where the boundary is between enabling legitimate police work and giving (accidentally or deliberately) the police the power to plant fake evidence, the latter being what some of this sounds like. But, I’m not a legal expert, and “sounds like” is a way to make very large mistakes when looking outside of one’s own domain of expertise like I’m doing here. (Also doesn’t help that I hear about stories like this from people who don’t like them, so I get a potentially biased first impression).

BiteCode_dev 5y ago
They could always do that: once they have a warrant, they can search your house and pretend to find physical evidences in it.
- ben_w 5y ago
  Indeed they could. However the linked page says: > A DATA DISRUPTION WARRANT enables the agencies to “add, copy, delete or alter” data on devices. With the exception of the word “copy”, this makes it seem like the plan is to make it not merely possible but also legally acceptable for anyone given such a warrant to create/place that evidence (or delete things to make real data look incriminating by lack of context). Again, I really know I can’t trust my interpretation of any legal text, all I can say is it does sound bad to an outsider like me.
nonameiguess 5y ago
I have no idea how Australia handles this, but in the U.S., the process of discovery is what is supposed to keep the police from just planting evidence. Prosecution needs to present all evidence that will be used against you, including exactly where it came from and chain of custody. If they can't, it gets thrown out. The only exception is they can't be compelled to give away the identity of confidential informants. But a confidential informant also can't testify anonymously, so the police would always need additional evidence beyond the word of a CI. It's not a perfect system by any means. The police can and do plant evidence. But a lot of convictions also get thrown out and this is often why obviously guilty people get off on "technicalities" because the police don't follow procedure down to the letter. The opposite end of the spectrum, not giving the police any power to do covert surveillance at all, is effectively just giving a license to the Mafia to do whatever it wants, as anyone who just commits all of their crimes privately will get away with it as long as they can sufficiently scare or kill anyone who would otherwise have been willing to testify. It's a tradeoff either way, and we try to let there be a middle ground, where the police can bug your house, tap your phone, hack your router, but they need a warrant that has to be granted by a completely separate branch of government that is not in the same chain of command, and they have to prove to your lawyers that they obtained all of the evidence they have against you legally.
- ben_w 5y ago
  Indeed, I have no issue with the police having the power to read whatever data a warrant grants. My problem is the linked page says: > A DATA DISRUPTION WARRANT enables the agencies to “add, copy, delete or alter” data on devices. Copy is fine, it’s the other three which are scary. Perhaps they shouldn’t be scary, perhaps they have well-defined meanings in law I’m just not familiar with (like how “Hacker News” has nothing to do with cyber crime), but I can only respond within the limits of my knowledge, and that seems scary.
  - aljp 5y ago
    I think the reason they want the ability to add, delete, and alter is so they can disrupt certain users, software, or services legally, like botnets or arms deals. It's probably too broad and could be abused though.

matheusmoreira 5y ago

It's certainly better than simply compromising everyone but it's not like they're going to stop their mass surveillance activities. This is just a step towards legitimization of those activities. It's time for computer security to include nation states in their threat model. We need tamper-evident hardware.