3 ms·

Legal question: if you had whole-disk encryption, and the duress password just zeroized the decryption key, would that be "destroying evidence?" Especially if t

by Animats 2mo ago

Legal question: if you had whole-disk encryption, and the duress password just zeroized the decryption key, would that be "destroying evidence?" Especially if there was a recovery possible but not instantly available, such as a Yubikey in a safe deposit box in a bank. That would take a subpoena to get, and there is an opportunity to challenge the subpoena in court first. Not instantly at the border. Something like that should be a standard feature of a secure phone.

Taek 2mo ago
I do like the idea of forcing due process to access an encryption key. I'm not sure if that idea is compatible with current law, but it seems just at the very least.
- KingMob 2mo ago
  IANAL, but I understand that part of the problem is, prior to official admission to the US, you have fewer rights even if you're a US citizen.
  - tobylane 2mo ago
    Also not a lawyer, but some of that applies to anyone within 100 miles of a border, a coastline. This isn't the case, but if that rule also applied to airports, then I wonder what portion of the population is safe.
seanhunter 2mo ago
If you want actual legal advice pay for an actual lawyer. You aren’t going to get it asking a bunch of randoms on a tech forum. Since we’re techies we tend to think about technological nuances and have a certain literal frame of mind (eg “They can’t make it illegal for me to just type the wrong pin” is the type of thinking I’m talking about here) whereas in law weird precedents and your intent really matter so you really need expert advice and either way, you are throwing yourself at the mercy of a stochastic process that depends on a bunch of fallible humans along the way many of whom have the power to make your life extremely miserable. Technicalities of destroying the data vs destroying the key to the data, destroying the data when you have a backup etc may matter a lot to us but may not mean anything in an actual judicial process depending on how it goes. It seems to me if you have data you don’t want subject to seizure at a border it is best not to travel over the border carrying that data. If you have a backup (in your scenario), why not restore your phone from that backup after you have travelled, and not cross the border with anything that is likely to be a problem if seized? Then you’re not putting yourself at risk from this process.
- gyomu 2mo ago
  > we tend to think about technological nuances and have a certain literal frame of mind see the colored bits essay for an ur-example of this https://ansuz.sooke.bc.ca/entry/23 https://ansuz.sooke.bc.ca/entry/23
- iririririr 2mo ago
  What about the opposite? remove the tech from the hypotetical. Say you carry a valise with a lock. They ask for the key, you truthfully answer that you do not have with you. They burn the valise and lose all the contents. So, are you in jail? or can you sue them for destroying your stuff?
  - Jolter 2mo ago
    What the point of this hypothetical? In real life they would break the lock on your valise and return it to you bound together with tape.
    - iririririr 2mo ago
      and how if this similar to how a duress password work? say breaking the lock burn the contents somehow, to prevent documents falling into thief's hands for the sake of the comparison.
  - otterley 2mo ago
    You didn’t tamper with the potential evidence; they did.
    - iririririr 2mo ago
      right. that's my point. why if they try to guess your password and end up wiping data, then magically you're guilty?
      - Jolter 2mo ago
        Intent matters in a court of law. A judge or a jury will consider: - did you intend for the data to be destroyed in an eventual search? - probably yes, because you went to the trouble to set up a duress password - is it reasonably that you mixed up the two passwords? No, because only an idiot would make them similar and you're clearly no idiot, because you were able to set up a phone with a duress password. - hence, you intentionally made the officer wipe your data, and you will be held liable. It doesn't make any difference if the destroyed potential evidence is physical or digital. The law as written is stupid, but that does not mean courts are stupid. It is rather funny to look at how some programmers believe they can "trick" the law. It does not work like computer code!
dosisking 2mo ago
The law means nothing. The law is "interpreted" by judges. If the government wants you to be guilty, they will find a way to make that happen. They don't care about the rule of law. The US has a 99% conviction rate, highest ever in recorded history.
- hiddencost 2mo ago
  Conviction rate only measures cases brought to trial. The overwhelming fraction of cases do not go to trial.
  - qeternity 2mo ago
    It's the other way around: conviction rate includes plea bargains. Convictions at trial are much lower.
- qeternity 2mo ago
  You are misunderstanding the conviction rate. Only ~2% of cases actually go to trial, and at trial there is ~80% conviction rate. There are ~4x as many cases dismissed by judges before getting to trial. And the vast majority (90%) of defendants enter into plea bargains. Prosecutors only bring charges when they feel they have a strong case. There are many many cases which are never pursued because of this, and people also get upset about that. Many countries do not have a plea bargain system the way the US does. And if you look at conviction rates at trial, they are smack in line with much of e.g. Western Europe.
  - thereforegrin 2mo ago
    wouldn't you go into plea bargain if you knew there's 80% chance of conviction of you don't? At some point the high conviction rate acts as a deterrent from not entering a plea. IMHO this is the case in the US and has been for quite some time.
    - acdha 2mo ago
      That’s repeating the misunderstanding: the conviction rate is high because the government voluntarily drops or reduces charges when their case is weak. You have to think of it as “80% of the cases the government thought it would win” rather than “80% of all cases ever considered”. What does lead to pleas is the expense of defending a case: if you acknowledge some guilt, you might decide to accept a lesser charge rather than exhaust your finances with no guarantee that you won’t get that lesser charge anyway.
Gareth321 2mo ago
I am not a lawyer. 1. Intent matters. If you give the password to a Customs and Border Protection agent which deletes all the data, your intent was to deceive them and either delete evidence, or at least fail to comply with their request. CBP has wide powers of search. 2. CBP has broad remit to deny entry to any non-citizen for any and no reason. Even if not illegal to provide a duress password, they can and will send non-citizens back home.
- siilats 2mo ago
  You need to be a bit tricky. Your phone can either require a yubikey or not. You have two pins, 1234 that doesn't require Yubikey and 2345 that turns the phone into yubikey required mode. So what you do before crossing the border is you type in 2345 yourself and turn your phone into yubikey required mode. And if you forgot and the customs agent types in 2345 even though 1234 would have opened the phone without yubikey, nobody can prove you didn't do the 2345 before entering customs. In practice if you give the customs 1234 and are nice to cbp you get your phone back in 48 hours, just make sure you get the email address of the agent in charge not just name and generic phone number.
sebstefan 2mo ago
This guy's been charged with obstruction not destroying evidence so they could still charge you with obstruction for failing to give a password that opens the phone up.

by Animats 2mo ago

Taek 2mo ago

I do like the idea of forcing due process to access an encryption key. I'm not sure if that idea is compatible with current law, but it seems just at the very least.

KingMob 2mo ago
IANAL, but I understand that part of the problem is, prior to official admission to the US, you have fewer rights even if you're a US citizen.
- tobylane 2mo ago
  Also not a lawyer, but some of that applies to anyone within 100 miles of a border, a coastline. This isn't the case, but if that rule also applied to airports, then I wonder what portion of the population is safe.

seanhunter 2mo ago

If you want actual legal advice pay for an actual lawyer. You aren’t going to get it asking a bunch of randoms on a tech forum. Since we’re techies we tend to think about technological nuances and have a certain literal frame of mind (eg “They can’t make it illegal for me to just type the wrong pin” is the type of thinking I’m talking about here) whereas in law weird precedents and your intent really matter so you really need expert advice and either way, you are throwing yourself at the mercy of a stochastic process that depends on a bunch of fallible humans along the way many of whom have the power to make your life extremely miserable. Technicalities of destroying the data vs destroying the key to the data, destroying the data when you have a backup etc may matter a lot to us but may not mean anything in an actual judicial process depending on how it goes. It seems to me if you have data you don’t want subject to seizure at a border it is best not to travel over the border carrying that data. If you have a backup (in your scenario), why not restore your phone from that backup after you have travelled, and not cross the border with anything that is likely to be a problem if seized? Then you’re not putting yourself at risk from this process.

gyomu 2mo ago
> we tend to think about technological nuances and have a certain literal frame of mind see the colored bits essay for an ur-example of this https://ansuz.sooke.bc.ca/entry/23 https://ansuz.sooke.bc.ca/entry/23
iririririr 2mo ago
What about the opposite? remove the tech from the hypotetical. Say you carry a valise with a lock. They ask for the key, you truthfully answer that you do not have with you. They burn the valise and lose all the contents. So, are you in jail? or can you sue them for destroying your stuff?
- Jolter 2mo ago
  What the point of this hypothetical? In real life they would break the lock on your valise and return it to you bound together with tape.
  - iririririr 2mo ago
    and how if this similar to how a duress password work? say breaking the lock burn the contents somehow, to prevent documents falling into thief's hands for the sake of the comparison.
- otterley 2mo ago
  You didn’t tamper with the potential evidence; they did.
  - iririririr 2mo ago
    right. that's my point. why if they try to guess your password and end up wiping data, then magically you're guilty?
    - Jolter 2mo ago
      Intent matters in a court of law. A judge or a jury will consider: - did you intend for the data to be destroyed in an eventual search? - probably yes, because you went to the trouble to set up a duress password - is it reasonably that you mixed up the two passwords? No, because only an idiot would make them similar and you're clearly no idiot, because you were able to set up a phone with a duress password. - hence, you intentionally made the officer wipe your data, and you will be held liable. It doesn't make any difference if the destroyed potential evidence is physical or digital. The law as written is stupid, but that does not mean courts are stupid. It is rather funny to look at how some programmers believe they can "trick" the law. It does not work like computer code!

dosisking 2mo ago

The law means nothing. The law is "interpreted" by judges. If the government wants you to be guilty, they will find a way to make that happen. They don't care about the rule of law. The US has a 99% conviction rate, highest ever in recorded history.

hiddencost 2mo ago
Conviction rate only measures cases brought to trial. The overwhelming fraction of cases do not go to trial.
- qeternity 2mo ago
  It's the other way around: conviction rate includes plea bargains. Convictions at trial are much lower.
qeternity 2mo ago
You are misunderstanding the conviction rate. Only ~2% of cases actually go to trial, and at trial there is ~80% conviction rate. There are ~4x as many cases dismissed by judges before getting to trial. And the vast majority (90%) of defendants enter into plea bargains. Prosecutors only bring charges when they feel they have a strong case. There are many many cases which are never pursued because of this, and people also get upset about that. Many countries do not have a plea bargain system the way the US does. And if you look at conviction rates at trial, they are smack in line with much of e.g. Western Europe.
- thereforegrin 2mo ago
  wouldn't you go into plea bargain if you knew there's 80% chance of conviction of you don't? At some point the high conviction rate acts as a deterrent from not entering a plea. IMHO this is the case in the US and has been for quite some time.
  - acdha 2mo ago
    That’s repeating the misunderstanding: the conviction rate is high because the government voluntarily drops or reduces charges when their case is weak. You have to think of it as “80% of the cases the government thought it would win” rather than “80% of all cases ever considered”. What does lead to pleas is the expense of defending a case: if you acknowledge some guilt, you might decide to accept a lesser charge rather than exhaust your finances with no guarantee that you won’t get that lesser charge anyway.

Gareth321 2mo ago

I am not a lawyer. 1. Intent matters. If you give the password to a Customs and Border Protection agent which deletes all the data, your intent was to deceive them and either delete evidence, or at least fail to comply with their request. CBP has wide powers of search. 2. CBP has broad remit to deny entry to any non-citizen for any and no reason. Even if not illegal to provide a duress password, they can and will send non-citizens back home.

siilats 2mo ago
You need to be a bit tricky. Your phone can either require a yubikey or not. You have two pins, 1234 that doesn't require Yubikey and 2345 that turns the phone into yubikey required mode. So what you do before crossing the border is you type in 2345 yourself and turn your phone into yubikey required mode. And if you forgot and the customs agent types in 2345 even though 1234 would have opened the phone without yubikey, nobody can prove you didn't do the 2345 before entering customs. In practice if you give the customs 1234 and are nice to cbp you get your phone back in 48 hours, just make sure you get the email address of the agent in charge not just name and generic phone number.

sebstefan 2mo ago

This guy's been charged with obstruction not destroying evidence so they could still charge you with obstruction for failing to give a password that opens the phone up.