The law depends on compute power
medium.com
medium.com
It doesn't.
The law is interpreted by humans, based on case law, and attempts to understand the intentions of the law as written.
Many programmers don't like this, but that is how the law operates.
(If the author would like to go down another rabbit hole, perhaps he should consider if encrypted information is actually published at all. After all, well designed encryption renders information quite close to random noise in the absence of a key. Perhaps making encrypted information available isn't actually publishing - maybe it is the act of posting how to decrypt it that is the act of publishing.
Note that here, the law would answer "it depends", and that is fine.)
It also has something in common with the well known xkcd comic with the punchline "why does your field need a whole journal".
It is possible to for clever legal arguments to do fairly amazing things. When Richard Covey invented the Grantor Retained Annuity Trust (GRAT) he all but repealed the estate tax for large estates. But it takes a hell of a lot of knowledge, hard work, and luck to come up with something like that. It's not the type of thing that's at all likely to happen when you haven't even bothered to study the area of law and learn the terms of art or read the case law and instead just google up some statutes and apply "common sense".
All the important case, all the ones lawyers rely upon in arguments, began with a court or judge breaking from the pattern. That's why they progress up to higher authorities. That's why they supersede previous caselaw.
For example, the case Olmstead v. U.S. was a big deal in the 20s when the Supreme Court said the fourth amendment protection for "persons, houses, papers, and effects" didn't apply to taps on telephone wires. I disagree with that result not because it "openly defies logic" but because my understanding of the underlying importance of privacy is at odds with those of the justices. That's not a dispute about logic, it's a disagreement about values.
Given the arguments surrounding searches of "private papers", I'd analogize 'publishing' an encrypted SSN to be somewhat like putting a document in the public square... in a safe.
Unless you're watching one of those stupid TV shows where they make this look easy. Just call up something on the screen and say "enhance". Then zoom in again and "enhance". Until you get the result you want. The problem is those scenes are written by liberal arts TV writers who didn't even pay attention to science in grade school.
It's not real world physics as I understand it. But, as Dennis Miller used to say, "I could be wrong". I'd welcome a pointer to some scientific explanation of how it is possible.
Suppose there is some thing the law says you can't publish. You encrypt it with AES, throw away the key and then publish the ciphertext. It's not at all clear that the law is going to punish you for that -- nobody can read the information anymore, so whatever evil the law was intended to prevent is not occurring, and anyway the government is going to have a hard time proving their case since without the key they can't actually prove what the ciphertext is.
Now suppose you do the same thing but instead of AES you use 40-bit DES, which anybody can easily break with modern hardware. Now you're arguably publishing the thing, and the government can prove what the ciphertext is, so the outcome could be different. But that wouldn't have been the case in the 1970s when computers were slower.
So what is it about the conclusion that the law could depend on the state of computing power and algorithms that you find so implausible?
For example, suppose Comey succeeds in mandating encryption backdoors. Then the backdoor gets compromised and published. You suddenly have an obligation to use an encryption mechanism you know is compromised to transmit things you have an obligation to keep secret. Catch 22.
In theory a court might realize the absurdity of that situation and let you out of one of the obligations, but how do you know which one it will be? Or that they won't still demand that you do both, effectively requiring you to shut down your business until the government changes the law?
And now you've got yourself some trouble, because the intent for publishing the free speech flag can reasonably be as criticism of laws purporting to make certain information illegal. Then you're publishing political speech which is a whole different ballgame.
But the better point is that people have become quick to dismiss the math, as if facts and logic and reality are irrelevant to the law. The law has to live inside the universe. It has to do something when the problems the math proves can happen actually do.
So for example, the xor situation is interesting. If you xor with random bytes, the result is indistinguishable from random and is capable of encoding literally any information of equal or smaller length -- at the same time -- by changing what you xor it back with. So A xor B is the Declaration of Independence while A xor C is DeCSS, C xor D is the Bill of Rights and C xor E is a trade secret document.
Now suppose there are some websites allowing anyone to publish xor-encoded data (or arbitrary data). Somebody uploads A to one such website and C to another. Anybody who asks about A, you can show them B and it encodes the Declaration of Independence. Anybody who asks about C, you can show them D and it encodes the Bill of Rights. So now A and C are being published by separate sites, each is indistinguishable from random, but xor them together and you get DeCSS.
DeCSS is being published, but who is publishing it? Who can be forced to remove their half, when doing so would also delete arbitrarily many instances of lawful speech that require the same random bytes (and could be the only copy)? What is the status of B and D, given that you can xor them with public documents to get back A and C? What if you can prove that A is preexisting and C is derived from DeCSS and A? What if there is no way to prove which existed first?
If somebody does this, there has to be an answer better than hand-wavy dismissal of inconvenient math.
In court the judge would attempt to judge the intent of each person involved and rule based on that. You seem to think this is a problem, and indeed it is hard. That why the law uses judges rather than attempting to legislate every possible example.
But the better point is that people have become quick to dismiss the math, as if facts and logic and reality are irrelevant to the law. The law has to live inside the universe. It has to do something when the problems the math proves can happen actually do.
No. This is the key thing you are missing. Elsewhere on this thread someone put it like this: "I would add the concept that the law, unlike software, is capable of openly defying logic. Courts are permitted to dismiss case law and rule in a completely new and unforeseen direction."
The Law is lazily evaluated, in a specific court, in the context of a specific case. It does not follow that the logic in one case applies in another - sometimes it might, sometimes it might not, and things like the intent of the people involved matter.
It isn't. If you encrypt something with most algorithms, there is going to be one key that turns it back into something intelligible and all the others produce garbage. That isn't the case with xor. Different "keys" will produce different intelligible decryptions.
> In court the judge would attempt to judge the intent of each person involved and rule based on that. You seem to think this is a problem, and indeed it is hard. That why the law uses judges rather than attempting to legislate every possible example.
The hardness is the problem. Suppose somebody sends you a DMCA takedown for what appears to be random numbers, arguing that if you xor it with some specific other random numbers you get infringing content. But that proves nothing because it's true for everything, so what are you supposed to do? What is the judge supposed to do?
> No. This is the key thing you are missing. Elsewhere on this thread someone put it like this: "I would add the concept that the law, unlike software, is capable of openly defying logic. Courts are permitted to dismiss case law and rule in a completely new and unforeseen direction."
How is that supposed to solve anything? The problem isn't that the court is going to come across "this statement is false" and have a meltdown, the problem is that we can't predict what the court is actually going to do so we don't know how to behave if we want to stay within the law.
And furthermore that there isn't anything good for the court to do. Of course the court is not required to do something good, but how is it OK when they do something bad?
You do, as soon as you're pointing someone towards C.
One of the main errors techies make about the law is that they tend to see a problem to prove something as fatal to a law.
By this logic pointing out that there are drug dealers in Detroit is distribution of narcotics, pointing out that there is money in a bank is conspiracy to commit bank robbery, publishing a vulnerability is publishing everything on every system with that vulnerability, etc.
It's also an obvious practical problem since you've reduced the resources necessary to publish something from having to host a multi-gigabyte piece of content and have enough bandwidth to distribute it to millions of people, down to distributing a couple of hyperlinks. Which you might do with a mailing list or RSS feed that all the interested parties will then already have a local copy of before anybody can do anything about it, or from a different jurisdiction because transit from overseas is no longer prohibitively expensive.
> One of the main errors techies make about the law is that they tend to see a problem to prove something as fatal to a law.
It's supposed to be. If you can convict someone without proving their guilt then you can convict anyone regardless of their guilt.
You're pointing to C because you want people to xor it with A (and you're probably telling them that, too).
When I say "there are dealers on the corner", I don't want you to buy drugs.
When someone else says the exact same thing, he might want you to buy drugs.
He and I are treated differently by the law.
Ad the second point: no, it's not! You've got it the wrong way around. I'm not talking about convicting someone wihtout proof. On the contrary, I'm saying that the fact that we cannot prove every murder does not mean that the murder statute is fatally flawed and must be repealed.
> When someone else says the exact same thing, he might want you to buy drugs.
> He and I are treated differently by the law.
And that's where the whole thing falls apart. Because it means there are circumstances that allow someone to tell people where they can buy drugs, so the person who wants to tell everyone where to buy drugs can pretend to be doing it for the same reason you are.
I can come up with some plausible valid intentions for doing the xor thing, but lets use the real case. DMCA 1201 prohibits trafficking in circumvention tools. Intent doesn't matter, because there are very obvious legitimate non-infringing uses for "circumvention tools" and nothing about the tool changes based on the intent of the user, so allowing circumvention tools for non-infringing uses would allow them to be widespread (which they are anyway, but never mind that now). However, prohibiting circumvention tools for non-infringing uses may be unconstitutional.[1] So intent has to matter but if intent matters then in practice that law can't be effective. Which means we shouldn't have that law.
[1] https://www.eff.org/press/releases/eff-lawsuit-takes-dmca-se...
> I'm not talking about convicting someone wihtout proof. On the contrary, I'm saying that the fact that we cannot prove every murder does not mean that the murder statute is fatally flawed and must be repealed.
The problem isn't with statutes where you can't prove every instance, the problem is with statutes where every perpetrator can make themselves look like an innocent person and the only way to convict them is to make an assumption that would also convict the innocent people.
There might be other factors to take into account that change that result slightly, but it's not really different from a crime that doesn't involve computers.
You're assuming that you know which one the "second one" is.
The "first" file may have originally been hosted somewhere else or distributed privately. Some hosts don't keep high granularity timestamps or any timestamps at all, or the user may control the timestamp. How do you know who was first?
That said law is still a system with capacity and limited "power" that is not very different from a computer.
So what you are saying is that "loopholes" in the law actually don't exist, because those loopholes run counter to the intentions of the law? Interesting!
A good example is the backdoor Roth IRA, which lets you exceed the Roth contribution limit by transiting your money through a traditional IRA (which has no limit) and then converting it to a Roth IRA (which has no limit). It's well-known that you can do this, and the legislature has had plenty of opportunities to put a contribution on either of these two steps. But they haven't. It would contradict the will of the legislature for a judge to say, "Look, obviously they didn't mean that," because at this point if they meant that they would have said it.
Oftentimes loopholes are from being overly specific on certain terms, rather than specifying intent more broadly.
> It doesn't.
It's illogic, inconsistent and incomplete, is that what you are trying to say? Or is there some higher order logic that computers can't calculate?
> and that is fine
From your description of what the law should be, "fine" could mean anything. Should I attempt to understand the intentions? Perhaps you are saying, you yourself don't have an issue with it, but that is not generalizable. In my own terms, that's an opinion. And that's a matter of fact. Albeit, I'm bad with maths and computers, so I can't prove it a fact.
Formal logic would lead to bad things, for example, imagine a state bans sex with animals. You'd be guilty of having sex with your wife because she's an animal.
The law isn't precisely stated so formal logic is the wrong tool.
Law uses different sorts of logic. If you are curious, take a look at LSAT questions. That's the sort of logic and reasoning lawyers value.
> preposition
It's called proposition, so I take that as evidence for a complete lack of familiarity with the topic of logic.
> Except ...
except the point is completely wrong but for the exemplary sentiment, that some interpreters of law don't even pretend to be reasonable.
Put all the citizens in that state in Jail. What were they thinking!?
The lack of definitions, the fuzzy logic is the problem. Yet, I am often amazed by accurate law codes, and I am far more astonished by how wrongly I and others use those words contrary to their original usage. I accept that words are defined by their usage. I cannot accept competing definitions. Point in case, I wouldn't say humans are animals, and historic usage proves me right AFAICR from reading on free will etc. At best, a human is a mammal. But you seem to want to use the word differently, so, I agree that this doesn't really work.
268-91-7112
That is a social security number, but I guarantee you I will not be prosecuted for publishing it. What is illegal is publishing the binding between a particular social security number and a particular person.
Geeks get way too hung up on this idea that publishing these things should be OK because "they're just numbers." No, they are not "just numbers". They are numbers with some associated semantics. This number is Bill's SSN, that number is Sony's secret key. It's the semantics that matter, not the number.
Either way, the fact that the third is legal means that the law depends on compute power.
That sounds like a very pragmatic view of the legal system. I'm more idealistic so I'd rather say that you have to "prove" (rather than "determine") their intent before you can punish them. ;P
Look, I'm not saying you're wrong, but there absolutely are times when the "geeks" win. For example consider export control for cryptographic algorithms which was thoroughly ridiculed by "geeks" [1] and later scrapped IIRC.
Legal system may try to handle the issue - in this particular case, it's possible to just ignore the primary intent and decide whenever an intent to publish did exist instead - but sometimes it just fails. I think that's, for example, how PGP source code was exported, working around munitions export laws.
[1] It must be dual. In a same manner formal logic can not be always applied to the realm of legal affairs, laws may malfunction when asked to handle problems from the domains they don't really map to.
https://en.wikipedia.org/wiki/Illegal_number
I think at the time what I found ridiculous was that you were prohibited from "having" the number, but of course nobody could say what number it was you weren't allowed to have... seemed like something that belonged in Dr. Strangelove.
Could someone from the US care to explain why publication of these numbers is such a big deal, and why it can lead to identity theft (an idea that I see often on the internet)?
In Spain we have a unique ID number and it is pretty common to see them published all over the place. The government and administrations routinely publish lists of people with their name and ID number, for example if you have applied for a public sector job, a government grant, etc. your ID number will be published in a list that everyone can see and even find on Google. We don't see it as a problem because knowing someone's ID number doesn't mean you can steal their identity - to do that they would need to forge the actual ID card, for in-person procedures, or steal passwords or keys, for online stuff. Knowing the number alone doesn't give you access to anything. In fact, it is publicly known that the current king has the ID number 15 and the former king 10 (number 1 corresponded to dictator Franco who created the system), but it's not that easy to go around impersonating the king :)
What can you do if you know a person's social security number in the US?
Perhaps the answer lies in the fact that the US has no national ID. IDs are issued at the state level and the details vary from state to state. This helps make it easier to forge identification because locals will not be familiar with the standards of all fifty states. So, due to the lack of a national ID, we use the federal social security number in a manner it was never intended to try to fill in this hole in our system.
The political organization of the US is a little bit like the EU rather than a country per se. Each state is a little bit like a separate country in some ways. There are overarching federal laws, but a lot varies from state to state, just like a lot varies from country to country in the EU.
"What can you do?" With Duke Energy, the electric provider in my last apartment complex, you would have absolutely no problem registering for electric in someone else's name and having them on the hook for it if you knew their SSN.
You can do stuff like apply for lines of credit using a SSN. If you use my name and my number its presumed to be me applying for the credit.
That's interesting... in Spain does getting credit require an in-person appointment? Because maybe that's a simple answer to 2/3 of the identity theft in the U.S.
There are some online banks without offices, but typically they are subsidiaries of physical banks, or they have deals with them, so they will only give you credit if they have seen you at the physical bank first.
You can use an SSN to map to an existing credit file. From there, you establish accounts with places with poor verification practices and use them to move up the food chain.
Some states historically were very week in verification for state ID -- best case you have an audit able link between a birth certificate, lease and/or parental affidavit. Few people can be linked to a biometric. (Other than headshot photo)
The actual answer is: the law is all about intent.
All intellectual property rights are limitations on free speech. Courts rule against the publication of exact copies, or identical copies in different media, every day. IP law requires courts to prevent copying else it be meaningless. The flag is not an expression of a new idea, it is a facsimile of a protected number, protected data little different than a copyrighted movie or patented design. Its publication could only be legal as some sort of "fair use", but exact copies that directly impact the financial viability of protected material rarely fall within fair use.
They would rule against the flag. If persons want to express themselves using this material, they need to add some form of comment so as to avail themselves of fair use protection. Add a stripe to the flag and get back to us.
Rolling a die and publishing a number between 1 and 6 is not copyrightable.
Would a single number of 20 bytes be a "work?" Even if it's almost certainly generated through strong random? That seems unlikely.
What Sony could do would seem be civil action under "trade secrets" and/or the EULA.
Dunno if that's the actual interpretation though?
(have law degree, not practising lawyer)
In the civil world, the issue would be one of harm. You aren't going to sustain a lawsuit unless you can state some harm. So long as nobody can read the encrypted material, there is no harm. But as soon as someone does you've got a case to bring.
There is an interesting statute of limitations question here as to when the clock starts, but that is a minor procedural issue imho. Many such statutes start not at the wrongdoing, but at the realization of the harm (or reasonable time of realization).
This is not something that's new or unique to technology, although technology does a fantastic job of illustrating the difference between a legal problem and a technological problem - as well as the different mindsets you have to approach both with.
An exhaustive list of all US SSNs will be mishandled, intercepted and posted online. It is only a matter of when, rather than if.
(For precedents of whole-country database dumps, see the Turkish, Philippines and Qatar cases.)
The most obvious one is that it assumes the United States social security number system (and the United States itself) will exist for infinite time.
> Make all SSNs public
There's obviously a huge difference between publishing a number and publishing a number with a message next to it saying "this number is the password for X". Clearly the intent of the law is to stop the latter.
Meanwhile, designing systems that can uniquely identify consumers/customers/employees/suppliers/students with a generally unique ID world lead to a reduction in error rates and increased efficiency.
Security must be solved with told designed for it (state issued signing key/device?)