3 ms·
Fun question: my company security policy required that, when I installed Linux on the laptop, I enabled disk encryption at rest. If it's seized for legal discov
by zeta0134 2y ago
Fun question: my company security policy required that, when I installed Linux on the laptop, I enabled disk encryption at rest. If it's seized for legal discovery, am I obligated to unlock it for them? Who is in trouble if I refuse? (me, obviously, because the resulting interrogation will be unpleasant, but it's the principle of the thing)
- unsnap_biceps 2y agoI am not a lawyer, but I would presume you would be in legal trouble. If the company refused to tell you to unlock the laptop, they would be in trouble for refusing legal discovery, and if they were wanting to refuse legal discovery, they wouldn't have handed over the laptop in the first place. If the company ordered you to unlock the laptop and you refused, you would be violating a lawful order of the court and would be held responsible. That said, once again, I am not a lawyer, so I could be completely wrong
- DrammBA 2y agoWhat if he forgot the password with all the stress from the lawsuit?
- unsnap_biceps 2y agoIt's been attempted and they were charged with contempt of court https://www.digitaltrends.com/computing/contempt-of-court-decrypt-password/ https://www.digitaltrends.com/computing/contempt-of-court-de...
- wruza 2y agoPretty sure it’s per-case per-judge basis, not a general rule. Generalizing over a half-confessed guy makes a good scary headline. In the article the guy unlocked his phone app (a hint he was initially talked into confession). Which gave extra evidence to what his sister claimed. And it was a csam case which rendered him way less sympathetic. Remove any of that and the balance may change. The judge has to find a reasonable cause for contempt first. Would they charge him with contempt if he just lawyered up and forgot everything from the start? All that said it doesn’t mean you want to risk it for some company, even remotely. The guy probably weighted both deals after realizing where he’s in and chose a lighter one. You may want to not get either one.
- taylodl 2y agoYou should be keeping all your passwords in a password vault, at a minimum. Even better would be to use a password manager. You should have too many passwords of too high of complexity to commit them all to memory.
- marssaxman 2y agoHow would you get into such a password vault without first decrypting your disk? On my Linux machine with full disk encryption, the system doesn't even boot until I type in the password.
- ptero 2y agoI doubt it. The companies that require whole disk encryption should have the keys. They generally implement multi-key setups or keep the key at the IT and block the user from changing it. If they didn't and you forgot your key -- ah well. My 2c.
- unsnap_biceps 2y agoThe context of the question was the person installed Linux on their laptop and enabled FDE themselves without using the corporate setup, so presumably corporate wouldn't have the keys to unlock it. As for forgetting your password, that's been attempted unsuccessfully before. https://www.digitaltrends.com/computing/contempt-of-court-decrypt-password/ https://www.digitaltrends.com/computing/contempt-of-court-de...
- more_corn 2y agoYou can be held in jail indefinitely for contempt of court. I believe there are currently people incarcerated for exactly this right now.