4 ms·

At this point, everything encrypted at rest will be a must.

Cthulhu_ 4y ago
And even then, weaknesses are built into encryption, long-term it may be broken with advances in computing (I mean who knows what the NSA and co are working on at the moment), etc. It's better to not do or have anything illegal. Make it so you can say "I have nothing to hide", but don't give them access voluntarily because of that.
- wongarsu 4y ago
  If NSA has a backdoor or has broken the encryption you are using, they will want to keep that secret for as long as possible to get the greatest possible use out of it. They will use it covertly (using parallel construction to keep it out of court cases) on important cases like (actual) national security, mafia or people running dark net marketplaces, spying on friendly and hostile governments etc. But they won't risk it for someone with a CSAM match or anything similarly uninteresting, and local authorities won't even be aware that it's something their government can do. Still, don't do anything illegal, but I think for most people it's legitimate to have a threat profile that assumes that encryption is effective.
kayodelycaon 4y ago
Then encryption becomes evidence of guilt, unless you give up the key so they can search it to make sure you're not guilty.
- kevincox 4y ago
  This is not how it works at least in Canada and the US. Until they can read the password out of our minds (or at least prove that we have it) we don't need to give up the key.
  - op00to 4y ago
    Are you so sure? Also, why don't they just beat the shit out of you to get the key?
  - SamuelAdams 4y ago
    Technically correct however courts can hold you in contempt. There was one case where a suspect was arrested and refused to give up passwords to hard drives. The prosecution had reasonable evidence (allegedly) that those hard drives contained child pornography, however since the defendant failed to provide access the prosecution could never prove it. Other good points were brought up - why not dismiss the hard drive as evidence and use other “proof” such as network logs, computer thumbnails caches from the defendants personal computer, etc? Personally I’m not sure if those ideas were ever explored. https://arstechnica.com/tech-policy/2020/02/man-who-refused-to-decrypt-hard-drives-is-free-after-four-years-in-jail/ https://arstechnica.com/tech-policy/2020/02/man-who-refused-...
  - dodobirdlord 4y ago
    I can't speak for Canada, but in the US if a court issues a search warrant for data stored on one of your devices you are obligated to take whatever steps are necessary to turn over the data, including decrypting the data if applicable. This power is provided to the government by the 4th Amendment. What you are likely referring to is the 5th Amendment right that protects a person from being compelled to testify against themselves, which protects a person from being compelled to turn over a password if doing so would incriminate them, but this is only applicable in circumstances where turning over the password would incriminate you, not where the decryption of the data would incriminate you. This is applicable only in circumstances where it is uncertain whether you have access to the device in question, since compelling you to produce the password amounts to compelling you to admit that it is your device. Once a court is satisfied that it is beyond doubt that the device is yours and you know the password, a judge is free to compel you to provide the password. There's a further consideration of whether you can refuse if the literal string of the password itself would incriminate you, but I don't believe that has been conclusively litigated.
    - Ferrotin 4y ago
- tluyben2 4y ago
  Yeah also not, they will need to have proof of at least connections with some criminal networks to compel you to do that.
  - nerdponx 4y ago
    Parallel construction though.
- 8345570934 4y ago
  I don't think that works in countries with a jury system. I don't have anything illegal on my computers, but I would never give up my passwords to anyone working for the government. I think the odds that at least one person who is like me (or can at least understand that mindset) will be on any given jury is pretty good.

And even then, weaknesses are built into encryption, long-term it may be broken with advances in computing (I mean who knows what the NSA and co are working on at the moment), etc. It's better to not do or have anything illegal. Make it so you can say "I have nothing to hide", but don't give them access voluntarily because of that.

wongarsu 4y ago
If NSA has a backdoor or has broken the encryption you are using, they will want to keep that secret for as long as possible to get the greatest possible use out of it. They will use it covertly (using parallel construction to keep it out of court cases) on important cases like (actual) national security, mafia or people running dark net marketplaces, spying on friendly and hostile governments etc. But they won't risk it for someone with a CSAM match or anything similarly uninteresting, and local authorities won't even be aware that it's something their government can do. Still, don't do anything illegal, but I think for most people it's legitimate to have a threat profile that assumes that encryption is effective.

kayodelycaon 4y ago

Then encryption becomes evidence of guilt, unless you give up the key so they can search it to make sure you're not guilty.

kevincox 4y ago
This is not how it works at least in Canada and the US. Until they can read the password out of our minds (or at least prove that we have it) we don't need to give up the key.
- op00to 4y ago
  Are you so sure? Also, why don't they just beat the shit out of you to get the key?
- SamuelAdams 4y ago
  Technically correct however courts can hold you in contempt. There was one case where a suspect was arrested and refused to give up passwords to hard drives. The prosecution had reasonable evidence (allegedly) that those hard drives contained child pornography, however since the defendant failed to provide access the prosecution could never prove it. Other good points were brought up - why not dismiss the hard drive as evidence and use other “proof” such as network logs, computer thumbnails caches from the defendants personal computer, etc? Personally I’m not sure if those ideas were ever explored. https://arstechnica.com/tech-policy/2020/02/man-who-refused-to-decrypt-hard-drives-is-free-after-four-years-in-jail/ https://arstechnica.com/tech-policy/2020/02/man-who-refused-...
- dodobirdlord 4y ago
  I can't speak for Canada, but in the US if a court issues a search warrant for data stored on one of your devices you are obligated to take whatever steps are necessary to turn over the data, including decrypting the data if applicable. This power is provided to the government by the 4th Amendment. What you are likely referring to is the 5th Amendment right that protects a person from being compelled to testify against themselves, which protects a person from being compelled to turn over a password if doing so would incriminate them, but this is only applicable in circumstances where turning over the password would incriminate you, not where the decryption of the data would incriminate you. This is applicable only in circumstances where it is uncertain whether you have access to the device in question, since compelling you to produce the password amounts to compelling you to admit that it is your device. Once a court is satisfied that it is beyond doubt that the device is yours and you know the password, a judge is free to compel you to provide the password. There's a further consideration of whether you can refuse if the literal string of the password itself would incriminate you, but I don't believe that has been conclusively litigated.
  - Ferrotin 4y ago
tluyben2 4y ago
Yeah also not, they will need to have proof of at least connections with some criminal networks to compel you to do that.
- nerdponx 4y ago
  Parallel construction though.
8345570934 4y ago
I don't think that works in countries with a jury system. I don't have anything illegal on my computers, but I would never give up my passwords to anyone working for the government. I think the odds that at least one person who is like me (or can at least understand that mindset) will be on any given jury is pretty good.