9 ms·

I really like his sort of thing, but realize that, like anti-forensics tools, there is a risk to having and using destructive anti-tamper triggers. If the poli

by ipsin 12y ago

I really like his sort of thing, but realize that, like anti-forensics tools, there is a risk to having and using destructive anti-tamper triggers. If the police actually think you're up to something, raid you, and your "cybernetic boobytrap" destroys your hundreds of GB of actual random data, they may still try and prove that you're a terrible person and destroyed evidence in court. Then it's up to a jury, and a prosecutor bent on making you look guilty as hell. I'm not trying to dissuade exploration, but understand what can happen if you actually deploy this sort of system.

nateberkopec 12y ago
IANAL: what could actually happen to you, legally, if your hard-drive self-destructs after being tampered with? Is that really "destroying evidence?" What if you just shut down the computer, rendering the hard drive unusable, its contents completely encrypted (a la TrueCrypt). The evidence isn't destroyed, it's just inaccessible.
- wyldfire 12y ago
  > What if you just shut down the computer Good idea. It's probably the safest/most paranoid to trigger an NMI or bus reset. Should be extremely low latency.
- tomtoise 12y ago
  Not sure which country you hail from, but I know that there are laws compelling you to hand over keys generally worldwide[1]. So I guess it depends if the crime you're guilty of (Otherwise why would you even need to hide everything) outweighs the punishment for withholding keys. [1]http://en.wikipedia.org/wiki/Key_disclosure_law#United_Kingdom http://en.wikipedia.org/wiki/Key_disclosure_law#United_Kingd...
  - WorldWideWayne 12y ago
    "I forget" Is forgetting (or losing) the key a crime?
    - nhayden 12y ago
      In the UK, yes. In the US, yes, if they can show evidence that you should know the key.
      - WorldWideWayne 12y ago
        It works for so many Presidents and Congressmen though! Honestly, if I have a 32 character master-password on a strip of paper in my wallet and I just happen to lose my wallet before I get raided, then I'm pretty sure that I could show that I simply don't know the key.
        dragonwriter 12y ago
        The hard part would be to prove that you "just happened" to lose your wallet before you got raided, rather than disposed of it in expectation of the raid. Or that the whole story of that being where the key was is true, in the first place.
        Ripsaw 12y ago
        Isn't the burden of proof on the police to prove that you are lying? So if neither side has proof it must be assumed that you did indeed just happen to lose it.
        cmdkeen 12y ago
        It's also on you to tell that story convincingly. Because realistically would you write down the pass key in only one place? That's all of your data after all. Your livelihood if you're a developer etc. You may get asked what sort of things losing that password has cost you, if you're the sort of person who has that level of security that probably means you're locked out of all sorts of other systems (thanks to now not having access to private keys) so they can be subpoenaed to see if you've managed to log into your hosting account recently despite not having the private key to do so. And if you magically have preserved your private keys elsewhere why should you be believed that your passkey solely exists on a piece of paper in your wallet... What about your friends, co-workers etc who might be compelled to testify as to having seen you work on your computer and have never seen you get your wallet out at any point. And as soon as that isn't believed all other testimony you may give is tainted because you've just lied to the court. Good luck with any mitigation in the event of a guilty plea as well because you've demonstrated you haven't acted in good faith.
  - wyager 12y ago
    Thankfully, the USA still has a fair amount of really strong legal protection from the bill of rights (1st-10th amendments). The 5th amendment protects US citizens from being forced to reveal their encryption keys. Forced key disclosure with sentencing for failure to disclose (like in the UK) is particularly odious. If I have a hard drive full of random data, the UK government can imprison me for up to five years just by accusing me of terrorism or child pornography possession and demanding that I turn over the key to the hard drive. They don't have to prove that I did what they're accusing me of, or that I even have a key.
    - justizin 12y ago
      "The 5th amendment protects US citizens from being forced to reveal their encryption keys." Tell that to Ladar Levison. ;)
    - nkw 12y ago
      > The 5th amendment protects US citizens from being forced to reveal their encryption keys. This is far far from decided or well settled. I can think of countless instances where it is likely false.
      - robkix 12y ago
        I wonder, though, if your key were a confession to a crime you did actually commit (perhaps you stole a pack of gum) and you cannot be compelled to testify against yourself, how would that turn out?
        nkw 12y ago
        This has gone both ways so far in cases in the United States[1]. One of the fundamental questions is whether or not you giving up the key is testimonial or not. There is a litany of things which have been held to not be testimonial, and thus not implicated by the 5th amendment, including giving up your saliva, blood, fingerprints, standing in a line up, etc. The really interesting legal question to me is as neuroscience advances, it is likely in the near future that scientists may be able recover one's key (or other relevant information regarding crime) through studying one's brain by imaging or the use of other sensors. Under current case law there is a really really good argument this would not be testimonial (i.e. it is similar to taking your fingerprints or blood), yet provides the same information they could obtain by compelling your testimony. Does the 5th Amendment prohibit the government from scanning your brain to obtain information about a crime? I think there is a significant number of judges who would find under current law it does not. [1] http://en.wikipedia.org/wiki/Key_disclosure_law#United_States http://en.wikipedia.org/wiki/Key_disclosure_law#United_State...
- detaro 12y ago
  IANAL as well, and obviously depends on the jurisdiction, but as far as I understand previous discussions: using a tamperproof or encrypted disk is mostly fine. Actively triggering anything that destroys data after you've been become aware of the fact that law enforcement has a warrant is not. Dead-man switch kind of things are harder to categorize, e.g. having a daemon format the disk if GPS reports locations outside a certain area, or if you don't press a key kombination every 2 minutes (is one allowed to lie about them if asked?) if you just use encryption you might be forced to turn over the keys.
- maxlybbert 12y ago
  In the US, it's generally a crime to destroy evidence if you believe there's an investigation. So setting something up to respond to evidence of an investigation seems like a bad idea to me. In the US, it's also possible to be held in contempt of court for failing to hand over evidence in some cases. There's the Fifth Amendment, but there are enough exceptions to the Fifth Amendment (e.g., I'm not actually charged with a crime, and instead I'm facing fines for not having the right licenses; or the evidence on my computers is meant to be used in proving somebody else committed a crime) that I would want to talk to a lawyer before telling a judge that "the evidence isn't destroyed, it's just inaccessible."
  - olefoo 12y ago
    There is a distinction between crime and acts that are morally wrong. For instance hiding Jews from the Nazis would be a crime from the Nazis point of view. But most anyone else would consider it to be the right thing to do. And given the increasing militarization of the police in the US, and the US governments openly acknowledged policy of torture and refusal to prosecute war criminals...[1] You should question whether or not your government is legitimate enough to be trusted in matters criminal and judicial. And since the most likely utility of a program like this one, is to prevent the heimatsicherheit from also wrapping up your friends and family. It may in fact be your moral duty to ensure the safety of others in your affinity group by taking such precautions. 1. as a sidenote the US incarcerates a greater percentage of it's population than soviet Russia ever did, even under Stalin.
    - robkix 12y ago
      > even under Stalin To be fair, Stalin had a habit of just killing people instead of sending them to the Gulag. Not that it excuses the US incarceration rate but your comparison isn't very good.
      - olefoo 12y ago
        It was intended to be offensive. Although, the actual numbers are quite disputed and most of the ones we hear should be considered propaganda. Besides which; we're hardly ones to point the finger over genocide these days (Iraq, Pakistan, all those Afghan wedding parties).
- danielweber 12y ago
  > The evidence isn't destroyed, it's just inaccessible. This isn't Star Trek. You don't win by outsmarting the computer like Captain Kirk does. The courts have dealt with these "I'm so clever" tricks thousands of times. They have little patience for them.
  - stainednapkin 12y ago
    They have plenty of patience if you have enough money.
  - justizin 12y ago
    I enjoy your snarkiness daniel, but I think it's a bit more complex than "I'm so clever", FDE is a feature of MacOSX, Ubuntu, and .. I dunno.. probably Windows by now? Who cares. They can essentially use all the tactics they would get you to use to reveal any other information, and if they have probable cause for that drive, the encryption keys are what they'll ask for. Destroying them could put you in a tough situation, because they might not believe you destroyed them. Proving that nowhere in the world do you have access to a few kilobyte is pretty hard, and although the burden of proof is generally on the prosecution, it's up to them and law enforcement to interpret that outside of court. Because federal judges are protected by Federal Marshals - DOJ employees - they also have an IMO unhealthy relationship with the DOJ.
    - jacquesm 12y ago
      You can be placed in lock-up until you cough up the keys. Sucks to be you if you don't have them and you're not believable.
    - cmdkeen 12y ago
      Full disk encryption isn't an "I'm so clever" excuse - take Ulbricht for instance even if he had shut down his computer before being arrested FDE wouldn't be help from someone asking his password. If you've been seen using the computer recently it's going to pretty hard to convince the courts that you don't know the FDE encryption password. "I'm so clever" is running something that destroys all the data on your laptop and then claiming that you didn't do that in response to an investigation (and therefore obstructed justice). Even with Truecrypt installed there's still plenty of ways evidence can be collected that can be used to demonstrate that you realistically have access to encrypted and hidden data. It isn't as simple as installing Truecrypt and thinking you're safe. Be it recently accessed documents lists for folders that don't exist, Truecrypt being installed, having software installed (and with recent execution dates) that don't have any corresponding data files anywhere on the system etc etc. Think of it like Cold War espionage - you could live your life by "Moscow Rules" where you do everything possible to be able to claim, convincingly, that you're not being so clever. However even very talented agents and intelligence assets failed to not slip up on many occasions, and it involved huge amounts of time, effort and money on their parts.
gpcz 12y ago
This program makes me nervous because its primary use case is to obstruct justice, which the author tries to get away from with a thinly-veiled excuse that it could also be used to defend against criminals. I understand that technology is ethically neutral (for example, this program could be used to hinder reverse-engineering of a sealed computing appliance), but the fact that they're basically advertising this thing to obstruct police investigations puts me off.
- skrebbel 12y ago
  Offtopic nitpick: technology is not ethically neutral but simply amoral. The lawnmower that cuts of your foot doesn't have issues with your foot. It's just rotating blades.
- iak8god 12y ago
  > This program makes me nervous because its primary use case is to obstruct justice, which the author tries to get away from with a thinly-veiled excuse that it could also be used to defend against criminals I agree that there's a problem with the author's messaging, but I think the problem is with this first as a tool for "when your house gets raided by the police..." There are all kinds of reasons to encrypt your data. Some of them involve obstructing justice, some involve protecting oneself from "justice," but there are many others. If you have a good reason to encrypt, then you probably have good reasons to protect your system using a program like this. Leaving aside the State, and more mundane robberies, some people have good reasons to be concerned about industrial espionage[1]. Tools like this seem like a good way to counter that. [1] http://www.infoworld.com/article/2615610/data-security/when-in-china--don-t-leave-your-laptop-alone.html http://www.infoworld.com/article/2615610/data-security/when-...
- NoMoreNicksLeft 12y ago
  > This program makes me nervous because its primary use case is to obstruct justice Given the number of raids that happen based on false CI information, typoed street addresses, or government overreach... it's not clear that the program is meant to be used primarily for that. The police aren't our friends. They don't protect us individually or collectively. Often we need to be protected from them. Any tool that can help with that is a good thing.
stronglikedan 12y ago
I'd probably rather them have no evidence and accuse me of destroying it, than for them to have evidence.
- Kequc 12y ago
  Digital laws are so barbaric and unbalanced today. I'd be worried they'd find a copy of an xfiles episode in some subfolder somewhere or god knows what. All of a sudden I'm facing federal prison and fines sizeable enough to ruin my entire life just because I was being 'accused' of xyz? I'll take the contempt of court conviction.

by ipsin 12y ago

nateberkopec 12y ago

IANAL: what could actually happen to you, legally, if your hard-drive self-destructs after being tampered with? Is that really "destroying evidence?" What if you just shut down the computer, rendering the hard drive unusable, its contents completely encrypted (a la TrueCrypt). The evidence isn't destroyed, it's just inaccessible.

wyldfire 12y ago
> What if you just shut down the computer Good idea. It's probably the safest/most paranoid to trigger an NMI or bus reset. Should be extremely low latency.
tomtoise 12y ago
Not sure which country you hail from, but I know that there are laws compelling you to hand over keys generally worldwide[1]. So I guess it depends if the crime you're guilty of (Otherwise why would you even need to hide everything) outweighs the punishment for withholding keys. [1]http://en.wikipedia.org/wiki/Key_disclosure_law#United_Kingdom http://en.wikipedia.org/wiki/Key_disclosure_law#United_Kingd...
- WorldWideWayne 12y ago
  "I forget" Is forgetting (or losing) the key a crime?
  - nhayden 12y ago
    In the UK, yes. In the US, yes, if they can show evidence that you should know the key.
    - WorldWideWayne 12y ago
      It works for so many Presidents and Congressmen though! Honestly, if I have a 32 character master-password on a strip of paper in my wallet and I just happen to lose my wallet before I get raided, then I'm pretty sure that I could show that I simply don't know the key.
      - dragonwriter 12y ago
        The hard part would be to prove that you "just happened" to lose your wallet before you got raided, rather than disposed of it in expectation of the raid. Or that the whole story of that being where the key was is true, in the first place.
        Ripsaw 12y ago
        Isn't the burden of proof on the police to prove that you are lying? So if neither side has proof it must be assumed that you did indeed just happen to lose it.
        cmdkeen 12y ago
        It's also on you to tell that story convincingly. Because realistically would you write down the pass key in only one place? That's all of your data after all. Your livelihood if you're a developer etc. You may get asked what sort of things losing that password has cost you, if you're the sort of person who has that level of security that probably means you're locked out of all sorts of other systems (thanks to now not having access to private keys) so they can be subpoenaed to see if you've managed to log into your hosting account recently despite not having the private key to do so. And if you magically have preserved your private keys elsewhere why should you be believed that your passkey solely exists on a piece of paper in your wallet... What about your friends, co-workers etc who might be compelled to testify as to having seen you work on your computer and have never seen you get your wallet out at any point. And as soon as that isn't believed all other testimony you may give is tainted because you've just lied to the court. Good luck with any mitigation in the event of a guilty plea as well because you've demonstrated you haven't acted in good faith.
- wyager 12y ago
  Thankfully, the USA still has a fair amount of really strong legal protection from the bill of rights (1st-10th amendments). The 5th amendment protects US citizens from being forced to reveal their encryption keys. Forced key disclosure with sentencing for failure to disclose (like in the UK) is particularly odious. If I have a hard drive full of random data, the UK government can imprison me for up to five years just by accusing me of terrorism or child pornography possession and demanding that I turn over the key to the hard drive. They don't have to prove that I did what they're accusing me of, or that I even have a key.
  - justizin 12y ago
    "The 5th amendment protects US citizens from being forced to reveal their encryption keys." Tell that to Ladar Levison. ;)
  - nkw 12y ago
    > The 5th amendment protects US citizens from being forced to reveal their encryption keys. This is far far from decided or well settled. I can think of countless instances where it is likely false.
    - robkix 12y ago
      I wonder, though, if your key were a confession to a crime you did actually commit (perhaps you stole a pack of gum) and you cannot be compelled to testify against yourself, how would that turn out?
      - nkw 12y ago
        This has gone both ways so far in cases in the United States[1]. One of the fundamental questions is whether or not you giving up the key is testimonial or not. There is a litany of things which have been held to not be testimonial, and thus not implicated by the 5th amendment, including giving up your saliva, blood, fingerprints, standing in a line up, etc. The really interesting legal question to me is as neuroscience advances, it is likely in the near future that scientists may be able recover one's key (or other relevant information regarding crime) through studying one's brain by imaging or the use of other sensors. Under current case law there is a really really good argument this would not be testimonial (i.e. it is similar to taking your fingerprints or blood), yet provides the same information they could obtain by compelling your testimony. Does the 5th Amendment prohibit the government from scanning your brain to obtain information about a crime? I think there is a significant number of judges who would find under current law it does not. [1] http://en.wikipedia.org/wiki/Key_disclosure_law#United_States http://en.wikipedia.org/wiki/Key_disclosure_law#United_State...
detaro 12y ago
IANAL as well, and obviously depends on the jurisdiction, but as far as I understand previous discussions: using a tamperproof or encrypted disk is mostly fine. Actively triggering anything that destroys data after you've been become aware of the fact that law enforcement has a warrant is not. Dead-man switch kind of things are harder to categorize, e.g. having a daemon format the disk if GPS reports locations outside a certain area, or if you don't press a key kombination every 2 minutes (is one allowed to lie about them if asked?) if you just use encryption you might be forced to turn over the keys.
maxlybbert 12y ago
In the US, it's generally a crime to destroy evidence if you believe there's an investigation. So setting something up to respond to evidence of an investigation seems like a bad idea to me. In the US, it's also possible to be held in contempt of court for failing to hand over evidence in some cases. There's the Fifth Amendment, but there are enough exceptions to the Fifth Amendment (e.g., I'm not actually charged with a crime, and instead I'm facing fines for not having the right licenses; or the evidence on my computers is meant to be used in proving somebody else committed a crime) that I would want to talk to a lawyer before telling a judge that "the evidence isn't destroyed, it's just inaccessible."
- olefoo 12y ago
  There is a distinction between crime and acts that are morally wrong. For instance hiding Jews from the Nazis would be a crime from the Nazis point of view. But most anyone else would consider it to be the right thing to do. And given the increasing militarization of the police in the US, and the US governments openly acknowledged policy of torture and refusal to prosecute war criminals...[1] You should question whether or not your government is legitimate enough to be trusted in matters criminal and judicial. And since the most likely utility of a program like this one, is to prevent the heimatsicherheit from also wrapping up your friends and family. It may in fact be your moral duty to ensure the safety of others in your affinity group by taking such precautions. 1. as a sidenote the US incarcerates a greater percentage of it's population than soviet Russia ever did, even under Stalin.
  - robkix 12y ago
    > even under Stalin To be fair, Stalin had a habit of just killing people instead of sending them to the Gulag. Not that it excuses the US incarceration rate but your comparison isn't very good.
    - olefoo 12y ago
      It was intended to be offensive. Although, the actual numbers are quite disputed and most of the ones we hear should be considered propaganda. Besides which; we're hardly ones to point the finger over genocide these days (Iraq, Pakistan, all those Afghan wedding parties).
danielweber 12y ago
> The evidence isn't destroyed, it's just inaccessible. This isn't Star Trek. You don't win by outsmarting the computer like Captain Kirk does. The courts have dealt with these "I'm so clever" tricks thousands of times. They have little patience for them.
- stainednapkin 12y ago
  They have plenty of patience if you have enough money.
- justizin 12y ago
  I enjoy your snarkiness daniel, but I think it's a bit more complex than "I'm so clever", FDE is a feature of MacOSX, Ubuntu, and .. I dunno.. probably Windows by now? Who cares. They can essentially use all the tactics they would get you to use to reveal any other information, and if they have probable cause for that drive, the encryption keys are what they'll ask for. Destroying them could put you in a tough situation, because they might not believe you destroyed them. Proving that nowhere in the world do you have access to a few kilobyte is pretty hard, and although the burden of proof is generally on the prosecution, it's up to them and law enforcement to interpret that outside of court. Because federal judges are protected by Federal Marshals - DOJ employees - they also have an IMO unhealthy relationship with the DOJ.
  - jacquesm 12y ago
    You can be placed in lock-up until you cough up the keys. Sucks to be you if you don't have them and you're not believable.
  - cmdkeen 12y ago
    Full disk encryption isn't an "I'm so clever" excuse - take Ulbricht for instance even if he had shut down his computer before being arrested FDE wouldn't be help from someone asking his password. If you've been seen using the computer recently it's going to pretty hard to convince the courts that you don't know the FDE encryption password. "I'm so clever" is running something that destroys all the data on your laptop and then claiming that you didn't do that in response to an investigation (and therefore obstructed justice). Even with Truecrypt installed there's still plenty of ways evidence can be collected that can be used to demonstrate that you realistically have access to encrypted and hidden data. It isn't as simple as installing Truecrypt and thinking you're safe. Be it recently accessed documents lists for folders that don't exist, Truecrypt being installed, having software installed (and with recent execution dates) that don't have any corresponding data files anywhere on the system etc etc. Think of it like Cold War espionage - you could live your life by "Moscow Rules" where you do everything possible to be able to claim, convincingly, that you're not being so clever. However even very talented agents and intelligence assets failed to not slip up on many occasions, and it involved huge amounts of time, effort and money on their parts.

gpcz 12y ago

This program makes me nervous because its primary use case is to obstruct justice, which the author tries to get away from with a thinly-veiled excuse that it could also be used to defend against criminals. I understand that technology is ethically neutral (for example, this program could be used to hinder reverse-engineering of a sealed computing appliance), but the fact that they're basically advertising this thing to obstruct police investigations puts me off.

skrebbel 12y ago
Offtopic nitpick: technology is not ethically neutral but simply amoral. The lawnmower that cuts of your foot doesn't have issues with your foot. It's just rotating blades.
iak8god 12y ago
> This program makes me nervous because its primary use case is to obstruct justice, which the author tries to get away from with a thinly-veiled excuse that it could also be used to defend against criminals I agree that there's a problem with the author's messaging, but I think the problem is with this first as a tool for "when your house gets raided by the police..." There are all kinds of reasons to encrypt your data. Some of them involve obstructing justice, some involve protecting oneself from "justice," but there are many others. If you have a good reason to encrypt, then you probably have good reasons to protect your system using a program like this. Leaving aside the State, and more mundane robberies, some people have good reasons to be concerned about industrial espionage[1]. Tools like this seem like a good way to counter that. [1] http://www.infoworld.com/article/2615610/data-security/when-in-china--don-t-leave-your-laptop-alone.html http://www.infoworld.com/article/2615610/data-security/when-...
NoMoreNicksLeft 12y ago
> This program makes me nervous because its primary use case is to obstruct justice Given the number of raids that happen based on false CI information, typoed street addresses, or government overreach... it's not clear that the program is meant to be used primarily for that. The police aren't our friends. They don't protect us individually or collectively. Often we need to be protected from them. Any tool that can help with that is a good thing.

stronglikedan 12y ago

I'd probably rather them have no evidence and accuse me of destroying it, than for them to have evidence.

Kequc 12y ago
Digital laws are so barbaric and unbalanced today. I'd be worried they'd find a copy of an xfiles episode in some subfolder somewhere or god knows what. All of a sudden I'm facing federal prison and fines sizeable enough to ruin my entire life just because I was being 'accused' of xyz? I'll take the contempt of court conviction.