3 ms·

If the judge believes you: "Okay! Sucks for the cops." If the judge does not believe you: "That's contempt. You can sit in jail until you decide to remember.

If the judge believes you: "Okay! Sucks for the cops." If the judge does not believe you: "That's contempt. You can sit in jail until you decide to remember." A better two words would be "hidden volume". https://www.truecrypt71a.com/documentation/plausible-deniability/hidden-volume/ https://www.truecrypt71a.com/documentation/plausible-deniabi...

userbinator 4y ago
...or "duress password".
jeroenhd 4y ago
It's trivial to find if a hidden volume is in use or not. It's a good defence against an abusive family member who isn't very tech-savvy, but it's useless against law enforcement.
- martinko 4y ago
  How exactly?
  - malfist 4y ago
    Source: Trust him. In all fairness, there is a lot of documentation in veracrypt's manual about how to properly hide a hidden partition, and how it's circumvented. Most of them rely on knowledge of the encrypted container over time. A single point in time is unlikely to reveal a hidden partition, but if you are being monitored that is possible. Please note that backups or wear leveling on an SSD, or just the TRIM command not deleting stored data can provide those points in time. Hidden partitions work best on magnetic drives. Read them here: https://veracrypt.eu/en/Security%20Requirements%20for%20Hidden%20Volumes.html https://veracrypt.eu/en/Security%20Requirements%20for%20Hidd...
  - jeroenhd 4y ago
    The hidden volume set up by Truecrypt has different offsets between the headers and the actual encrypted data. It's possible to move the encrypted volume 50GB from the header and fill the disk with random bytes, but it's not doable through the standard GUI. In an encrypted state, it's impossible to tell the difference between the hidden volume and random data. When you use your real passphrase, the primary header is decrypted and the hidden volume may just be random-data empty space. If the key you entered decrypts the random bytes between the first Truecrypt header and the first partition, it's clear that the key belongs to the secret header and not the normal partition. You can try to cover your tracks; you can use your hidden volume as the main volume and enter the main volume key when forced to come up with a password. However, you'll have to make sure the activity logs on the PC line up with the other logs available (i.e. increments in power on hours, external drive logs and timestamps, external access logs, etc.) that can prove that the partition you've unlocked doesn't contain the OS that caused all kinds of side effects. Hell, you can probably find something related to relocated sectors/wear levelling statistics to find the clusters that are in use. When the passphrase for the hidden volume has been entered, you can find the physical offsets of the encrypted data and find out that the first half the drive (or less, or more, depending on your setup) isn't mapped to your booted partition. A completely read-only OS with no logging outside RAM or connections to the outside might be used securely if you use the hidden volume as your main OS, but such a system would be too difficult to use properly. As always, opsec is crucial for security even if your software algorithms are absolutely perfect. If you follow the guidelines set forth by Veracrypt, it should be very difficult to prove the presence of a hidden partition. That does mean you should be using your secondary OS as often as your hidden OS and analysis from external devices (such as network traffic) should not be able to tell the difference between the two.
    - CobrastanJorji 4y ago
      You're totally right, but "we suspect there's a hidden volume" and "this machine is clearly locked, unlock it" are two very different situations. The prosecution and even the judge might be convinced that it's extremely likely that you have a hidden volume, but that's not the same as compelling you to unlock a phone. It's the difference between "you are ordered to open the secret safe we suspect exists."
    - Fnoord 4y ago
      > A completely read-only OS with no logging outside RAM or connections to the outside might be used securely if you use the hidden volume as your main OS, but such a system would be too difficult to use properly. With Tails it'd be feasible. You'd have your user data on a hidden volume.
      - egberts1 4y ago
        Just as long as the hidden volume is not tipped off by an entry in /etc/passwd or something.
        Fnoord 4y ago
        In this example it can't (normally I'd say be careful with bash_history and such) since Tails would be ro.
    - egberts1 4y ago
      So having a read-only USB-media OS to boot into the either the-50G-in displacement of Truecrypt-hidden or just the unmoved regular standard-filesystem volume on a standard OS boot onboard magnetic media ... is best? Sounds like it is an OpSec risk to do the "resecuring of 50G re-displacement upon orderly shutdown" for "safest" traveling mode. One could forget or didn't have time to do that proper shutdown sequence.
Manuel_D 4y ago
How, exactly, does this work? Forgetting your phone's password potentially becomes a life sentence. In the US, a defendant was held in contempt of court. Eventually the courts decided that 18 months is the maximum incarceration period to try and force someone to give up a password [1]. Which still does seem pretty chilling: forgetting your password can land you a year and a half in prison. 1. https://arstechnica.com/tech-policy/2020/02/man-who-refused-to-decrypt-hard-drives-is-free-after-four-years-in-jail/ https://arstechnica.com/tech-policy/2020/02/man-who-refused-...
- Amezarak 4y ago
  The law is not executed by computers. It is executed by people operating via tradition and common sense. These have their own problems, and sometimes the law is bad, but this is a case where it works the way we’d hope given the law. Nobody is going to believe that you “forgot” the password to your phone that you use multiple times a day or at least a week. Your lawyer is not even going to mention that as an argument and he’s going to strongly advise you don’t because it sounds prima facie absurd. Now, if the case was about an encrypted hard drive you kept in your bank’s safety deposit box that you put there two years ago, it might work, because that sounds much more reasonable. Ed: and apply this to the very case you linked: the guy was held for the maximum contempt length possible because the evidence was so strong; they got his laptop, which indicated he downloaded illegal files to the external drives; they got his phone, which had illegal material; they have witnesses testifying that he showed them illegal material. If the encrypted drives had been their ONLY evidence, he almost certainly wouldn’t have been in jail for contempt.
  - Manuel_D 4y ago
    > the guy was held for the maximum contempt length possible because the evidence was so strong He was held for nearly 3 times the maximum contempt length because prosecutors argued he was not a witness even when they were holding in contempt for his refusal to give testimony. It's also in contradiction of existing precedence [1]. If you have a safe locked with a key, the government can demand you give them the key if it's in your possession. A safe locked with a combination, the government cannot ask you to produce the code. And to be clear, there's probably enough evidence to convict even without the contents of the encrypted drives. But that makes the imprisonment on contempt even more dubious: they don't need these contents and the defendant attempted to decrypt the drives and failed (intentionally or not, we can't know without a mind-reading device). 1. https://crsreports.congress.gov/product/pdf/LSB/LSB10416#:~:text=According%20to%20the%20court%2C%20while,to%20that%20safe%20would%20not https://crsreports.congress.gov/product/pdf/LSB/LSB10416#:~:....
77pt77 4y ago
> "That's contempt. You can sit in jail until you decide to remember." I know it works like that in the states, but does it also work like that in France? In most places contempt is limited in time.
- egberts1 4y ago
  And a 125-char password erodes in a brain-cellular storage over time thus ensuring no leakage of data, and an equally loss of liberty as well. Doesn't always pay to have longer password unless a corresponding threat exists to mandate such... a longer password.
- palunon 4y ago
  In france you are judged for a specific crime of not giving up (as in the article), carrying up to three years in prison and 270 000€ in fine. We don't really have contempt of court, mainly because we have a civil law system not a common law one. https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000032654251 https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI0000...
  - 77pt77 4y ago
    > We don't really have contempt of court, mainly because we have a civil law Contempt of court exists in civil law as well.
    - palunon 4y ago
      Civil law as in not common law, not civil law as in not penal law. Countries with civil law systems tend not to have contempt of court (or very limited versions). Of course, that's variable from country to country, civil and common law being more akin to trend than hard categories. https://en.wikipedia.org/wiki/Civil_law_(legal_system) https://en.wikipedia.org/wiki/Civil_law_(legal_system)

userbinator 4y ago

...or "duress password".

jeroenhd 4y ago

It's trivial to find if a hidden volume is in use or not. It's a good defence against an abusive family member who isn't very tech-savvy, but it's useless against law enforcement.

martinko 4y ago
How exactly?
- malfist 4y ago
  Source: Trust him. In all fairness, there is a lot of documentation in veracrypt's manual about how to properly hide a hidden partition, and how it's circumvented. Most of them rely on knowledge of the encrypted container over time. A single point in time is unlikely to reveal a hidden partition, but if you are being monitored that is possible. Please note that backups or wear leveling on an SSD, or just the TRIM command not deleting stored data can provide those points in time. Hidden partitions work best on magnetic drives. Read them here: https://veracrypt.eu/en/Security%20Requirements%20for%20Hidden%20Volumes.html https://veracrypt.eu/en/Security%20Requirements%20for%20Hidd...
- jeroenhd 4y ago
  The hidden volume set up by Truecrypt has different offsets between the headers and the actual encrypted data. It's possible to move the encrypted volume 50GB from the header and fill the disk with random bytes, but it's not doable through the standard GUI. In an encrypted state, it's impossible to tell the difference between the hidden volume and random data. When you use your real passphrase, the primary header is decrypted and the hidden volume may just be random-data empty space. If the key you entered decrypts the random bytes between the first Truecrypt header and the first partition, it's clear that the key belongs to the secret header and not the normal partition. You can try to cover your tracks; you can use your hidden volume as the main volume and enter the main volume key when forced to come up with a password. However, you'll have to make sure the activity logs on the PC line up with the other logs available (i.e. increments in power on hours, external drive logs and timestamps, external access logs, etc.) that can prove that the partition you've unlocked doesn't contain the OS that caused all kinds of side effects. Hell, you can probably find something related to relocated sectors/wear levelling statistics to find the clusters that are in use. When the passphrase for the hidden volume has been entered, you can find the physical offsets of the encrypted data and find out that the first half the drive (or less, or more, depending on your setup) isn't mapped to your booted partition. A completely read-only OS with no logging outside RAM or connections to the outside might be used securely if you use the hidden volume as your main OS, but such a system would be too difficult to use properly. As always, opsec is crucial for security even if your software algorithms are absolutely perfect. If you follow the guidelines set forth by Veracrypt, it should be very difficult to prove the presence of a hidden partition. That does mean you should be using your secondary OS as often as your hidden OS and analysis from external devices (such as network traffic) should not be able to tell the difference between the two.
  - CobrastanJorji 4y ago
    You're totally right, but "we suspect there's a hidden volume" and "this machine is clearly locked, unlock it" are two very different situations. The prosecution and even the judge might be convinced that it's extremely likely that you have a hidden volume, but that's not the same as compelling you to unlock a phone. It's the difference between "you are ordered to open the secret safe we suspect exists."
  - Fnoord 4y ago
    > A completely read-only OS with no logging outside RAM or connections to the outside might be used securely if you use the hidden volume as your main OS, but such a system would be too difficult to use properly. With Tails it'd be feasible. You'd have your user data on a hidden volume.
    - egberts1 4y ago
      Just as long as the hidden volume is not tipped off by an entry in /etc/passwd or something.
      - Fnoord 4y ago
        In this example it can't (normally I'd say be careful with bash_history and such) since Tails would be ro.
  - egberts1 4y ago
    So having a read-only USB-media OS to boot into the either the-50G-in displacement of Truecrypt-hidden or just the unmoved regular standard-filesystem volume on a standard OS boot onboard magnetic media ... is best? Sounds like it is an OpSec risk to do the "resecuring of 50G re-displacement upon orderly shutdown" for "safest" traveling mode. One could forget or didn't have time to do that proper shutdown sequence.

Manuel_D 4y ago

How, exactly, does this work? Forgetting your phone's password potentially becomes a life sentence. In the US, a defendant was held in contempt of court. Eventually the courts decided that 18 months is the maximum incarceration period to try and force someone to give up a password [1]. Which still does seem pretty chilling: forgetting your password can land you a year and a half in prison. 1. https://arstechnica.com/tech-policy/2020/02/man-who-refused-to-decrypt-hard-drives-is-free-after-four-years-in-jail/ https://arstechnica.com/tech-policy/2020/02/man-who-refused-...

Amezarak 4y ago
The law is not executed by computers. It is executed by people operating via tradition and common sense. These have their own problems, and sometimes the law is bad, but this is a case where it works the way we’d hope given the law. Nobody is going to believe that you “forgot” the password to your phone that you use multiple times a day or at least a week. Your lawyer is not even going to mention that as an argument and he’s going to strongly advise you don’t because it sounds prima facie absurd. Now, if the case was about an encrypted hard drive you kept in your bank’s safety deposit box that you put there two years ago, it might work, because that sounds much more reasonable. Ed: and apply this to the very case you linked: the guy was held for the maximum contempt length possible because the evidence was so strong; they got his laptop, which indicated he downloaded illegal files to the external drives; they got his phone, which had illegal material; they have witnesses testifying that he showed them illegal material. If the encrypted drives had been their ONLY evidence, he almost certainly wouldn’t have been in jail for contempt.
- Manuel_D 4y ago
  > the guy was held for the maximum contempt length possible because the evidence was so strong He was held for nearly 3 times the maximum contempt length because prosecutors argued he was not a witness even when they were holding in contempt for his refusal to give testimony. It's also in contradiction of existing precedence [1]. If you have a safe locked with a key, the government can demand you give them the key if it's in your possession. A safe locked with a combination, the government cannot ask you to produce the code. And to be clear, there's probably enough evidence to convict even without the contents of the encrypted drives. But that makes the imprisonment on contempt even more dubious: they don't need these contents and the defendant attempted to decrypt the drives and failed (intentionally or not, we can't know without a mind-reading device). 1. https://crsreports.congress.gov/product/pdf/LSB/LSB10416#:~:text=According%20to%20the%20court%2C%20while,to%20that%20safe%20would%20not https://crsreports.congress.gov/product/pdf/LSB/LSB10416#:~:....

77pt77 4y ago

> "That's contempt. You can sit in jail until you decide to remember." I know it works like that in the states, but does it also work like that in France? In most places contempt is limited in time.

egberts1 4y ago
And a 125-char password erodes in a brain-cellular storage over time thus ensuring no leakage of data, and an equally loss of liberty as well. Doesn't always pay to have longer password unless a corresponding threat exists to mandate such... a longer password.
palunon 4y ago
In france you are judged for a specific crime of not giving up (as in the article), carrying up to three years in prison and 270 000€ in fine. We don't really have contempt of court, mainly because we have a civil law system not a common law one. https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000032654251 https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI0000...
- 77pt77 4y ago
  > We don't really have contempt of court, mainly because we have a civil law Contempt of court exists in civil law as well.
  - palunon 4y ago
    Civil law as in not common law, not civil law as in not penal law. Countries with civil law systems tend not to have contempt of court (or very limited versions). Of course, that's variable from country to country, civil and common law being more akin to trend than hard categories. https://en.wikipedia.org/wiki/Civil_law_(legal_system) https://en.wikipedia.org/wiki/Civil_law_(legal_system)