6 ms·

Unfortunately, here's what will really happen: 5:30am, loud knock at the door. You open the door a crack to see who it is. Cops bust in. You're immediately han

by op00to 4y ago

Unfortunately, here's what will really happen: 5:30am, loud knock at the door. You open the door a crack to see who it is. Cops bust in. You're immediately handcuffed and sat outside. Cops take anything with a screen, usb plug, etc. All your media. All your computers. All your external hard drives. Every one of these devices will be imaged, and archived prior to being searched. The data will be kept for years, to protect against inevitable appeals, etc. But you know, good luck with your plan.

chinathrow 4y ago
At this point, everything encrypted at rest will be a must.
- Cthulhu_ 4y ago
  And even then, weaknesses are built into encryption, long-term it may be broken with advances in computing (I mean who knows what the NSA and co are working on at the moment), etc. It's better to not do or have anything illegal. Make it so you can say "I have nothing to hide", but don't give them access voluntarily because of that.
  - wongarsu 4y ago
    If NSA has a backdoor or has broken the encryption you are using, they will want to keep that secret for as long as possible to get the greatest possible use out of it. They will use it covertly (using parallel construction to keep it out of court cases) on important cases like (actual) national security, mafia or people running dark net marketplaces, spying on friendly and hostile governments etc. But they won't risk it for someone with a CSAM match or anything similarly uninteresting, and local authorities won't even be aware that it's something their government can do. Still, don't do anything illegal, but I think for most people it's legitimate to have a threat profile that assumes that encryption is effective.
- kayodelycaon 4y ago
  Then encryption becomes evidence of guilt, unless you give up the key so they can search it to make sure you're not guilty.
  - kevincox 4y ago
    This is not how it works at least in Canada and the US. Until they can read the password out of our minds (or at least prove that we have it) we don't need to give up the key.
    - op00to 4y ago
      Are you so sure? Also, why don't they just beat the shit out of you to get the key?
    - SamuelAdams 4y ago
      Technically correct however courts can hold you in contempt. There was one case where a suspect was arrested and refused to give up passwords to hard drives. The prosecution had reasonable evidence (allegedly) that those hard drives contained child pornography, however since the defendant failed to provide access the prosecution could never prove it. Other good points were brought up - why not dismiss the hard drive as evidence and use other “proof” such as network logs, computer thumbnails caches from the defendants personal computer, etc? Personally I’m not sure if those ideas were ever explored. https://arstechnica.com/tech-policy/2020/02/man-who-refused-to-decrypt-hard-drives-is-free-after-four-years-in-jail/ https://arstechnica.com/tech-policy/2020/02/man-who-refused-...
    - dodobirdlord 4y ago
      I can't speak for Canada, but in the US if a court issues a search warrant for data stored on one of your devices you are obligated to take whatever steps are necessary to turn over the data, including decrypting the data if applicable. This power is provided to the government by the 4th Amendment. What you are likely referring to is the 5th Amendment right that protects a person from being compelled to testify against themselves, which protects a person from being compelled to turn over a password if doing so would incriminate them, but this is only applicable in circumstances where turning over the password would incriminate you, not where the decryption of the data would incriminate you. This is applicable only in circumstances where it is uncertain whether you have access to the device in question, since compelling you to produce the password amounts to compelling you to admit that it is your device. Once a court is satisfied that it is beyond doubt that the device is yours and you know the password, a judge is free to compel you to provide the password. There's a further consideration of whether you can refuse if the literal string of the password itself would incriminate you, but I don't believe that has been conclusively litigated.
deleted 4y ago
[deleted]
_Algernon_ 4y ago
As if full disk encryption doesn't exist.
- newsclues 4y ago
  Encrypted data will be illegal for plebs. Failure to hand over passwords will be punished as if you are guilty of the worst thing imaginable.
  - _Algernon_ 4y ago
    I doubt it because at that point they cant pretend anymore to have rule of law, or being a democracy. Sure, it could be a gradual decent into such a reality, but it will take a long time.
    - seanw444 4y ago
      If they can justify to legislators being able to spy on all network traffic, they can probably also convince those same legislators that encryption is a tool only bad guys use to prevent justice being served. There's a constant push, at least in the US, for regulation on encryption. It's gotten consistently shot down thus far, thankfully. But it's a never-ending battle. And one day people will most likely become complacent enough to let go and feel the liberty melt away. Just like the last couple generations have gotten increasingly soft on our right to bear arms. They've been conditioned to believe that it's dangerous, and boomer-like, and no longer important.
    - zx85wes 4y ago
      France : "Loi no 2001-1062 du 15 novembre 2001 relative à la sécurité quotidienne, article 30 (Law #2001-1062 of 15 November 2001 on Community Safety) allows a judge or prosecutor to compel any qualified person to decrypt or surrender keys to make available any information encountered in the course of an investigation. Failure to comply incurs three years of jail time and a fine of €45,000; if the compliance would have prevented or mitigated a crime, the penalty increases to five years of jail time and €75,000.[21]" https://en.wikipedia.org/wiki/Key_disclosure_law https://en.wikipedia.org/wiki/Key_disclosure_law
tluyben2 4y ago
That won’t happen here but sure, US type of police overreach makes a better soundbite with horribly vague proposals like this. And people should be scared so I guess it’s good; maybe they will protest (probably not though because the children the children).
- blub 4y ago
  Here where? This is standard procedure in e.g. Germany based on press reports and articles written by lawyers. I don’t think it’s better in other European countries.
- adrianN 4y ago
  Stuff quite similar to that happens in Germany[1]. Where is "here"? [1] https://www.ccc.de/de/updates/2018/hausdurchsuchungen-bei-vereinsvorstanden-der-zwiebelfreunde-und-im-openlab-augsburg https://www.ccc.de/de/updates/2018/hausdurchsuchungen-bei-ve...
  - tluyben2 4y ago
    Netherlands. I wonder if it is similar: I saw a few here and they were friendly, no cuffs, they had a list of IPs, made an appointment to collect the drives etc (and that was with enough proof to know for sure they would find what they were looking for). But sure I can see how it escalates but why would they if there are no guns (usually only with drugs at which points they will come with more force)? Shame about Germany but why don’t we hear these things more; they should be on the front page of HN I guess (and not in German or in any language outside english if it awareness needs to be built)? At least the outline. So which dutch articles did I miss I wonder then; I cannot find any of these kind of overreaches. Also German lawyers seem to be far more trigger happy in a lot of cases than dutch like with copyright and not having your company info on your site etc; seems there is more litigation there like an industry looking for people to ‘sue’. Why aren’t people protesting or are they?
- seanw444 4y ago
  > That won't happen here Ah, those famous words.
emiliobumachar 4y ago
Don't forget the part where returning the original devices takes months or years, and of course you can't download a copy of the data if you lack a backup or the backup was also seized.

by op00to 4y ago

chinathrow 4y ago

At this point, everything encrypted at rest will be a must.

Cthulhu_ 4y ago
And even then, weaknesses are built into encryption, long-term it may be broken with advances in computing (I mean who knows what the NSA and co are working on at the moment), etc. It's better to not do or have anything illegal. Make it so you can say "I have nothing to hide", but don't give them access voluntarily because of that.
- wongarsu 4y ago
  If NSA has a backdoor or has broken the encryption you are using, they will want to keep that secret for as long as possible to get the greatest possible use out of it. They will use it covertly (using parallel construction to keep it out of court cases) on important cases like (actual) national security, mafia or people running dark net marketplaces, spying on friendly and hostile governments etc. But they won't risk it for someone with a CSAM match or anything similarly uninteresting, and local authorities won't even be aware that it's something their government can do. Still, don't do anything illegal, but I think for most people it's legitimate to have a threat profile that assumes that encryption is effective.
kayodelycaon 4y ago
Then encryption becomes evidence of guilt, unless you give up the key so they can search it to make sure you're not guilty.
- kevincox 4y ago
  This is not how it works at least in Canada and the US. Until they can read the password out of our minds (or at least prove that we have it) we don't need to give up the key.
  - op00to 4y ago
    Are you so sure? Also, why don't they just beat the shit out of you to get the key?
  - SamuelAdams 4y ago
    Technically correct however courts can hold you in contempt. There was one case where a suspect was arrested and refused to give up passwords to hard drives. The prosecution had reasonable evidence (allegedly) that those hard drives contained child pornography, however since the defendant failed to provide access the prosecution could never prove it. Other good points were brought up - why not dismiss the hard drive as evidence and use other “proof” such as network logs, computer thumbnails caches from the defendants personal computer, etc? Personally I’m not sure if those ideas were ever explored. https://arstechnica.com/tech-policy/2020/02/man-who-refused-to-decrypt-hard-drives-is-free-after-four-years-in-jail/ https://arstechnica.com/tech-policy/2020/02/man-who-refused-...
  - dodobirdlord 4y ago
    I can't speak for Canada, but in the US if a court issues a search warrant for data stored on one of your devices you are obligated to take whatever steps are necessary to turn over the data, including decrypting the data if applicable. This power is provided to the government by the 4th Amendment. What you are likely referring to is the 5th Amendment right that protects a person from being compelled to testify against themselves, which protects a person from being compelled to turn over a password if doing so would incriminate them, but this is only applicable in circumstances where turning over the password would incriminate you, not where the decryption of the data would incriminate you. This is applicable only in circumstances where it is uncertain whether you have access to the device in question, since compelling you to produce the password amounts to compelling you to admit that it is your device. Once a court is satisfied that it is beyond doubt that the device is yours and you know the password, a judge is free to compel you to provide the password. There's a further consideration of whether you can refuse if the literal string of the password itself would incriminate you, but I don't believe that has been conclusively litigated.

deleted 4y ago

[deleted]

_Algernon_ 4y ago

As if full disk encryption doesn't exist.

newsclues 4y ago
Encrypted data will be illegal for plebs. Failure to hand over passwords will be punished as if you are guilty of the worst thing imaginable.
- _Algernon_ 4y ago
  I doubt it because at that point they cant pretend anymore to have rule of law, or being a democracy. Sure, it could be a gradual decent into such a reality, but it will take a long time.
  - seanw444 4y ago
    If they can justify to legislators being able to spy on all network traffic, they can probably also convince those same legislators that encryption is a tool only bad guys use to prevent justice being served. There's a constant push, at least in the US, for regulation on encryption. It's gotten consistently shot down thus far, thankfully. But it's a never-ending battle. And one day people will most likely become complacent enough to let go and feel the liberty melt away. Just like the last couple generations have gotten increasingly soft on our right to bear arms. They've been conditioned to believe that it's dangerous, and boomer-like, and no longer important.
  - zx85wes 4y ago
    France : "Loi no 2001-1062 du 15 novembre 2001 relative à la sécurité quotidienne, article 30 (Law #2001-1062 of 15 November 2001 on Community Safety) allows a judge or prosecutor to compel any qualified person to decrypt or surrender keys to make available any information encountered in the course of an investigation. Failure to comply incurs three years of jail time and a fine of €45,000; if the compliance would have prevented or mitigated a crime, the penalty increases to five years of jail time and €75,000.[21]" https://en.wikipedia.org/wiki/Key_disclosure_law https://en.wikipedia.org/wiki/Key_disclosure_law

tluyben2 4y ago

That won’t happen here but sure, US type of police overreach makes a better soundbite with horribly vague proposals like this. And people should be scared so I guess it’s good; maybe they will protest (probably not though because the children the children).

blub 4y ago
Here where? This is standard procedure in e.g. Germany based on press reports and articles written by lawyers. I don’t think it’s better in other European countries.
adrianN 4y ago
Stuff quite similar to that happens in Germany[1]. Where is "here"? [1] https://www.ccc.de/de/updates/2018/hausdurchsuchungen-bei-vereinsvorstanden-der-zwiebelfreunde-und-im-openlab-augsburg https://www.ccc.de/de/updates/2018/hausdurchsuchungen-bei-ve...
- tluyben2 4y ago
  Netherlands. I wonder if it is similar: I saw a few here and they were friendly, no cuffs, they had a list of IPs, made an appointment to collect the drives etc (and that was with enough proof to know for sure they would find what they were looking for). But sure I can see how it escalates but why would they if there are no guns (usually only with drugs at which points they will come with more force)? Shame about Germany but why don’t we hear these things more; they should be on the front page of HN I guess (and not in German or in any language outside english if it awareness needs to be built)? At least the outline. So which dutch articles did I miss I wonder then; I cannot find any of these kind of overreaches. Also German lawyers seem to be far more trigger happy in a lot of cases than dutch like with copyright and not having your company info on your site etc; seems there is more litigation there like an industry looking for people to ‘sue’. Why aren’t people protesting or are they?
seanw444 4y ago
> That won't happen here Ah, those famous words.

emiliobumachar 4y ago

Don't forget the part where returning the original devices takes months or years, and of course you can't download a copy of the data if you lack a backup or the backup was also seized.